Limitation of liability in SaaS contracts: caps, carve-outs and super-caps

What the clause is made of

A limitation of liability clause has three moving parts, and most negotiations go wrong because the parties treat it as one.

The cap. The maximum a party will pay for all claims under the agreement. The market default in SaaS is the fees paid or payable in the twelve months before the claim. Customers open with a higher multiple; vendors of very low-priced products sometimes open with a fixed dollar figure. One-month caps, or a flat $100, are not a position — they are a signal that the vendor has never negotiated the clause.

The exclusions. Categories of loss neither party can recover regardless of the cap: indirect, consequential, special, punitive, lost profits, lost data. These are standard, mutual, and rarely worth a round — with one exception below.

The carve-outs. Obligations that sit outside the cap, the exclusions, or both. This is the real negotiation.

The carve-outs, ranked by how often they are conceded

Confidentiality — usually conceded

Breach of confidentiality is carved out of the cap by convention. The loss from a confidentiality breach is almost always indirect (lost business, reputational harm), so a vendor should check that the carve-out lifts the exclusions as well as the cap, or it is hollow.

Indemnification obligations — usually conceded, with a condition

The IP infringement indemnity is normally uncapped: the vendor is promising the customer will not be sued for using the product, and that promise is worth little if it stops at twelve months’ fees. The condition: the indemnity itself must be narrow. An uncapped indemnity for third-party IP claims is fine. An uncapped indemnity for “any breach of this Agreement” is unlimited liability by another name.

Gross negligence and wilful misconduct — conceded

Standard, mutual, and in many jurisdictions unenforceable to exclude anyway.

Data protection — the contested one

The customer’s argument: a breach of our users’ data exposes us to regulators and class actions, and twelve months of your fees is nothing against that. The vendor’s argument: you are asking a $30k-a-year subscription to insure your entire regulatory exposure. Both are correct, which is why the market has settled on the super-cap: a separate, higher limit for data-protection breaches — typically two to five times annual fees, sometimes a fixed figure tied to the vendor’s cyber insurance. It gives the customer meaningful recourse and gives the vendor a number they can insure.

Payment obligations — always carved out, never disputed

The customer’s obligation to pay fees is carved out of the cap on the customer side. Otherwise a customer could stop paying and hide behind the cap.

The exclusion that deserves a second look

“Loss of data” appears in most vendor exclusion lists. For a SaaS product whose entire purpose is to hold the customer’s data, excluding liability for losing it is a hard ask, and sophisticated customers will strike it. A defensible vendor position: exclude loss of data to the extent the customer failed to maintain its own backups or the loss arises from the customer’s configuration, and let the rest fall under the super-cap.

How it interacts with everything else

A workable vendor position

• General cap: 12 months’ fees, mutual.
• Exclusions: indirect and consequential loss, mutual; loss of data limited to the customer’s own failures.
• Carve-outs from the cap: confidentiality, IP indemnity, gross negligence and wilful misconduct, payment.
• Super-cap for data-protection breaches: 3x annual fees, or the insured amount if higher.
• Walk-away: uncapped liability for breach of contract generally; any carve-out that references a clause the customer controls.