Position of the week: why twelve months, and not three

A liability cap is a number that has to satisfy two tests. It must be large enough that the party who breaches has a real incentive not to. And it must be small enough that the party who gives it can insure it and price it. Twelve months’ fees passes both for most SaaS relationships.

Why not three

Three months’ fees on a $30,000-a-year subscription is $7,500. That does not compensate a customer for a serious failure and it does not deter a vendor from one. A cap that low is not a risk allocation; it is a refusal to allocate risk, and a sophisticated customer reads it that way.

Why not thirty-six

A three-year cap on a one-year subscription means the vendor is exposed to more than it will ever be paid. It cannot be priced into the fee without making the product uncompetitive, and it is usually above the vendor’s insurance limit, which means the customer’s recourse is theoretical anyway.

When we move

Up to twenty-four months for enterprise customers with real regulatory exposure, usually in exchange for something — a longer term, narrower carve-outs. Down only for genuinely low-value products where twelve months is a trivial sum, and then we would rather add a fixed floor than reduce the multiple. And the super-cap for data incidents is a separate conversation with its own number.

None of this is law. It is a position, held consistently, so that the negotiation can be about the deal rather than about first principles every time.