Indemnification clause explained for buyers and vendors

An indemnification clause moves financial risk from one signer to the other. If a customer, regulator or rights holder sues over something the clause covers, the indemnifying party pays the defense costs and any settlement. Whether you sign it as written depends on four things: the triggers, the scope of loss, the cap, and who controls the defense.

What an indemnification clause actually does

Without an indemnity, a company that gets sued because of a contract partner has to fight a messy battle. It sues the partner for breach, proves damages, and hopes the court agrees. An indemnification clause skips most of that. It says in advance that when a named kind of claim arrives, the indemnifying party steps in, pays, and sometimes runs the defense itself.

That makes it one of the most valuable and most expensive promises in a commercial agreement. A software vendor that indemnifies a customer against patent claims is effectively insuring the customer's use of the product. A customer that indemnifies a vendor against misuse of data is insuring the vendor's exposure to the customer's own conduct. The clause is a price tag attached to risk, and you should read it as one.

Read it as a budget line, not boilerplate.

Third party claims versus direct losses

The first question to ask is whether the clause covers only third party claims or also losses between the two signers. A narrow clause reads like this: the vendor will defend and pay if a third party claims the software infringes its intellectual property. A broad clause reads like this: the vendor will pay for any loss arising out of or relating to the services. The second version turns an indemnity into a blanket guarantee, and the words "arising out of or relating to" pull in nearly anything.

Most well drafted indemnities cover third party claims only. Direct losses between the parties are handled by the ordinary breach and damages provisions, which are in turn controlled by the limitation of liability clause. If an indemnity quietly covers direct losses, it can bypass the cap you negotiated elsewhere.

One more word to watch is "defend". A duty to defend arises as soon as a claim is made, before anyone knows whether it has merit, so the indemnifying party pays legal fees from day one. A duty only to indemnify arises after liability is established. The first is much more expensive for the giver and much more useful for the receiver, so check which verbs the clause actually uses.

The triggers that matter most

Every indemnity has a list of triggers. Common ones appear again and again, and each carries a different level of risk for the party giving the promise.

Each trigger deserves its own question: who controls the risk, and can that party insure it.

• Intellectual property infringement, usually given by the vendor for the product as delivered.
• Bodily injury, death or property damage caused by negligence or willful acts.
• Breach of confidentiality or data protection obligations, including a security incident involving customer data.
• Violation of law by the indemnifying party, including privacy, export and anti-corruption rules.
• Misuse of the product or content supplied by the other party, usually given by the customer.
• Gross negligence or willful misconduct, which is often the only trigger that survives a liability cap.

An example clause in plain words

Here is a typical vendor indemnity, translated. "Vendor will defend Customer against any third party claim alleging that the services, as provided by Vendor and used according to the documentation, infringe a patent, copyright or trade secret, and will pay the damages a court finally awards or that Vendor agrees in settlement. Vendor has no duty if the claim comes from Customer modifying the services, combining them with other products, or using them against the documentation."

In plain words, the vendor takes the lawsuit and pays the bill, but only for the product as shipped. If the customer bolts on its own code or uses the tool in a way never intended, the protection disappears. Those exclusions are fair in principle, yet a broadly written "combination" exclusion can swallow the whole promise, because almost every software product is used together with something else.

Procedure clauses decide whether the promise is usable

A generous indemnity can be worthless if the procedure is hostile. Look for four mechanics. First, notice: the indemnified party must tell the other side promptly, and a drafting trap makes late notice void the whole obligation even when the delay caused no harm. Better language says the duty is reduced only to the extent the delay actually prejudiced the defense.

Second, control of the defense. The indemnifying party usually gets to pick counsel and run the case, since it is paying. Third, settlement. The indemnifying party should not be able to settle in a way that admits fault for the other side or imposes obligations on it without consent. Fourth, cooperation, where the indemnified party supplies documents and witnesses at the indemnifying party's cost. If any of these is missing, ask for it. A clause that says "indemnify" and nothing else leaves each of these questions to a courtroom.

What buyers should push back on

If you are buying, you want the vendor's indemnity to be wide and the one you give to be narrow. Start with the vendor's IP indemnity and check that it covers all intellectual property rights, not only patents and copyrights, and that it applies worldwide if you operate abroad. Then check the remedy. A good clause adds that the vendor will procure the right for you to keep using the product, replace it with a non-infringing version, or refund prepaid fees.

Push on the data side too. If the vendor holds your customer records, ask for an indemnity covering a breach caused by its failure to meet the security obligations in the contract, including notification and credit monitoring costs. Many vendors offer only a capped damages remedy for this. Finally, resist any customer indemnity that says you will cover "any claim arising from your use of the services." That wording makes you the insurer of the vendor's whole business. Limit it to content you supplied and to use in violation of law or the agreed terms.

What vendors should push back on

Vendors face the opposite problem. A customer paper that demands indemnity for "any and all claims" tied to the services can leave a company with a 2,000 dollar a month product on the hook for losses of any size. Ask for four protections. A cap, even a high one, tied to fees paid in a recent period or a fixed multiple. A clear list of exclusions for customer modifications, customer data and use outside the documentation. A defined remedy that lets you replace or modify the product instead of paying open ended damages. And mutuality, so the customer also indemnifies you for its content and its legal compliance.

Also watch for indemnity for the customer's negligence, for claims by the customer's own affiliates, and for "consequential" losses folded in through the back door. Each one makes a predictable contract unpredictable, and each is usually negotiable when you explain the exposure in terms of annual contract value.

How the caps and carve-outs interact

An indemnity does not stand alone. The limitation of liability clause usually says whether indemnity obligations are inside the cap, outside it, or subject to a separate higher cap, called a super cap. Buyers often accept a modest general cap if the vendor's IP indemnity and data breach indemnity sit outside or under a larger one. Vendors push the other way and try to include everything under one number.

The practical test is simple. Read the indemnity, then read the cap, then ask what happens on the worst realistic day. If a single data incident could cost ten times the cap, you have either a negotiation to finish or a risk to accept deliberately. Many problems with indemnities do not come from bad drafting in one clause but from two clauses that quietly disagree with each other.

An indemnity is only as good as the party standing behind it. A small vendor can promise to cover a multimillion dollar claim, but if it has no assets and no insurance, the promise is paper. Buyers should ask what coverage backs the indemnity, typically commercial general liability, professional or technology errors coverage, and cyber coverage, and whether the contract requires the vendor to keep it in force and name the customer as an additional insured where that makes sense.

The reverse also applies. A customer that indemnifies a vendor for its own content should be able to afford it. When the other side is a startup, think about whether a smaller, insured cap is more useful than a large uncapped promise nobody can collect on. Also check survival language. Indemnity obligations should survive termination, since claims often arrive years after the relationship ends, and a clause that expires with the agreement leaves a gap exactly when the claim shows up.

Catching indemnity risk before you sign

Reading indemnification language across a stack of vendor contracts is slow, and the risky words sit in different places: the main agreement, an order form, a data addendum, sometimes a linked terms page. ContractsAnalyzer detects the indemnification clause in an uploaded contract, scores it against your playbook, and shows which triggers, exclusions and caps apply, with a plain-English summary of what you would be promising.

It also suggests fallback language you can export as a redline. The analyzer highlights what to check and proposes wording; it is not legal advice, so the final judgment on a high-value deal still belongs with you and your counsel.

Frequently asked questions

Related: Contract risk management software, AI contract review software that checks every clause against your playbook, Contract redlining software