Saya & Associates
SaaS liability caps: what founders should check before signing
The headline number has not changed. The exposure has
An enterprise customer agrees to cap liability at twelve months' fees, and the founder treats the negotiation as finished.
Later, the security schedule adds a separate obligation to reimburse incident costs, and the indemnity clause applies "notwithstanding any limitation" elsewhere. The cap is the same; the exposure is not.
Read the cap as part of the whole contract. A useful review explains which events are covered, how much money is at stake, and what remains outside the ceiling.
How is the cap calculated?
Start with the calculation, not the multiple. Does the cap use fees paid, fees payable, fees under the affected order, or fees across the whole relationship? Is the period measured before the incident, the claim or termination?
A hypothetical, not a recommended clause: a customer pays USD 2,000 a month, so twelve paid months total USD 24,000. A cap based only on fees actually paid in the three months before an incident could produce USD 6,000.
An annual prepayment, a free pilot or a separate implementation fee could change the answer again. Run the calculation for an incident in month one, one near renewal and one discovered after termination.
Also check whether the cap is aggregate across the agreement or available for each claim. The same figure can produce very different outcomes.
What sits outside the cap?
A carve-out removes a category of liability from the cap. A higher separate cap, often called a super-cap, sets a different ceiling for an agreed category. Neither label explains how the clause works without the operative wording.
| Event | Questions to resolve |
|---|---|
| Service outage | Do damages and service credits share the general cap? |
| Confidentiality breach | Is there a higher limit, no limit, or an exception inside the exception? |
| Third-party IP claim | Do defence costs and settlements count towards the cap? |
| Security incident | Which response costs are covered, and who approves them? |
| Unpaid subscription fees | Are payment obligations treated differently from damages? |
These are negotiation questions, not legal categories. A startup should not accept unlimited exposure just because a heading appears in the customer's template.
Equally, a very low general cap may not give the customer protection it reasonably needs.
Read indemnities and exclusions together
An indemnity allocates responsibility for a specified claim or cost. A cap limits the money payable. Check whether the agreement expressly brings indemnities within the cap.
Then read the indemnity procedure: notice, control of the defence, settlement approval and cooperation. Paying costs without any control over how they are incurred deserves particular attention.
Do not assume a heading excluding "consequential loss" removes every lost-profit or business-interruption claim.
Under Indian law, section 73 of the Indian Contract Act, 1872 allows compensation for loss that arose naturally in the usual course of things from the breach, or that the parties knew when contracting was likely to result.
It does not allow compensation for remote and indirect loss. That framework is not a ready-made reading of every SaaS exclusion clause; the wording and facts still decide.
Check the documents that change the answer
The limitation clause may sit in the master agreement, but the customer also signs an order form, a data processing agreement, a security addendum and a service-level schedule.
Read the order-of-precedence clause, and look for wording that overrides another document, creates a separate obligation or applies a different remedy.
A promise to reimburse all incident-response costs has to be reconciled with the agreed incident cap. Service credits described as the sole remedy for an availability failure need to be kept distinct from remedies for other breaches.
Record the version and date of every incorporated document. If online terms can change, identify the change process rather than assuming the signed PDF is the whole deal.
Governing law: an English-law comparison
A cap that is commercially agreed still needs an enforceability review under the governing law. The same wording may not work equally in every market.
For English-law business contracts, the Unfair Contract Terms Act 1977 can apply:
| Provision | Effect |
|---|---|
| Section 2(1) | Liability for death or personal injury caused by negligence cannot be excluded or restricted |
| Section 2(2) | Other negligence liability can be excluded or restricted only if the term is reasonable |
| Section 3 | Where one party deals on the other's written standard terms, the other cannot exclude or restrict its liability for breach unless the term is reasonable |
| Section 11(4) | For a cap at a specified sum, the court looks in particular at the resources available to meet the liability and how far insurance was available |
| Section 11(5) | The party relying on the term must show it is reasonable |
This does not mean every negotiated SaaS cap is invalid in England. It means a cap on standard terms needs to be defensible, and other countries have their own rules.
Compare the contract with the insurance
Read the actual policy wording, not the schedule's headline limit. Check the insured activities, territory, deductibles, exclusions and notification requirements.
A policy limit is not confirmation that the insurer covers every contractual promise up to that amount. Contractual liability assumed beyond what the law would impose is a common exclusion.
A review before signature
- Calculate the cap. Work out the figure for an early incident, one near renewal and one after termination, and whether it is aggregate or per claim.
- List what sits outside. Record every uncapped category and every separately capped one.
- Trace the indemnities. Note how defence costs, settlements, credits and reimbursements are treated, and who controls the defence.
- Check precedence. Identify which document wins if the agreement, order form, DPA and schedules conflict.
- Compare with insurance. Match the uncapped and super-capped exposures against the actual policy wording.
- Brief the approver. Give the person signing a one-page summary of the exposure the contract actually creates.
Frequently asked questions
Is twelve months' fees the legally required SaaS cap?
No. It is a common commercial structure, not a statutory amount or a safe harbour. The right cap depends on the service, the loss scenarios, the bargaining position and the governing law.
Does a liability cap automatically cover indemnity claims?
Not necessarily. Check whether the cap clause expressly includes indemnities, whether the indemnity says it applies "notwithstanding" the cap, and which document takes precedence.
Does a cap in the customer contract limit what a regulator can do?
No. A private allocation between the parties is not a ceiling on a regulator's powers or on a third party's independent rights. Those need separate analysis.
Is a cap on our standard terms enforceable in England?
It can be, but under section 3 and section 11 of the Unfair Contract Terms Act 1977 it must be reasonable, and the supplier relying on it must show that. Resources and insurance are relevant to a cap at a fixed sum.
Should our cap with customers match our suppliers' caps?
Not necessarily, but know the gap. A cloud supplier's lower cap does not reduce what you promised your customer, so make a deliberate decision about the mismatch.
The takeaway
The person approving the contract should be approving the exposure it creates, not recognising a familiar twelve-month formula. Put the calculation, the carve-outs and the insurance position on one page before signature.
If the same customer has sent a data processing agreement, see our guide to reviewing an EU customer's DPA.
To review an enterprise contract, contact Saya & Associates with the signature deadline; send confidential material only after the conflict check.
This article provides general information as at 16 October 2026. It is not a model clause or a view on enforceability. Governing law, mandatory rules, contract structure and the facts need individual assessment. It is not legal advice.