Grep · sample report

Contract Clause Benchmark — You get what is market for one clause in your contract type: typical positions, sourced example language, party-friendly variants, and fallback positions to concede in order.

workon demandinsight
Inputs used for this sample
Contract Clause Benchmark

Clause type: Limitation of liability

Industry or contract type: B2B SaaS master subscription agreement

Your side of the deal (optional): Customer, mid-market buyer with limited leverage

Governing law or jurisdiction (optional): New York law, US counterparties

Limitation of Liability in B2B SaaS MSAs: Customer-Side Benchmark (New York Law)

Bottom Line

For a mid-market customer with little leverage, the realistic landing point is a mutual cap of 12 months of fees, a super-cap of about 3x to 5x that amount for data and security claims, and a short list of uncapped claims (indemnities, confidentiality, fraud, gross negligence and willful misconduct). Common Paper's standard form defaults to 1x the fees paid or payable in the 12 months before the claim and offers an optional 5x Increased Cap Amount. Bonterms defaults to a 3x Enhanced Cap for security and data-protection breaches. Aggressive vendor paper is a one-way cap with no carve-outs; aggressive customer paper is no cap on vendor liability at all. The public evidence is moderate. I found 7 usable EDGAR exhibits (fewer than the 10 or so that would show a firm pattern), plus one aggregate dataset (TermScout, via a 2022 article) and several practitioner sources. The EDGAR sample skews to California-law vendor forms. New York law generally enforces commercial caps, but a 2020 Court of Appeals decision narrowed the public-policy backstop, so the customer should write its carve-outs into the contract rather than rely on case law.

Interpretation of inputs: "customer, mid-market, limited leverage" is read as a buyer signing mostly on the vendor's paper with room for two or three targeted asks. "US counterparties" is read as US-based vendors. No consumer or employment angle applies. This is market research, not legal advice; counsel should review against the full agreement.

Typical Range by Lever

Evidence labels: Filings = the 7 EDGAR exhibits (detail in the next section); Forms = Common Paper v3.0 and Bonterms v1.0; Data = aggregate survey data; Commentary = practitioner articles.

Lever Common position Aggressive customer-side Aggressive vendor-side Evidence basis
General cap amount 12 months of fees. In TermScout data, 51% of vendor forms with a cap set it at 12 months' fees, and 39% of negotiated agreements settled on 12 months No cap on vendor liability: almost 53% of customer forms call for uncapped vendor liability 3 to 6 months of fees: XMax at 3 months, mutual on its face but provider-favoring, Plaid at 6 months, one-way Data, Forms, Filings
Cap basis ("paid" vs "paid or payable") "Paid or payable" in Common Paper and Bonterms; "paid" in several vendor exhibits Paid or payable, plus a dollar floor Only fees "paid", or only for the single Service that caused the loss (Illumina) Forms, Filings
Mutuality Mutual in both templates Mutual, with the customer's payment duty outside the cap Vendor-only cap: Illumina, Plaid and Gulp Data cap only the vendor Forms, Filings
Super-cap for data, security, confidentiality Present in roughly a third of negotiated IT deals, though one practitioner interview says nearly universal in enterprise deals (anecdotal). TermScout: secondary caps in over 32% of negotiated agreements; practitioner view: market falls between 3x and 10x 5x to 10x, or uncapped for data breach (inference: 5x is the Common Paper option, 10x the top of one interviewee's range) None offered Data, Commentary (the two disagree on how common; see gaps)
Uncapped carve-outs Indemnities, confidentiality, fraud or willful misconduct, death or personal injury: each in over 40% of negotiated agreements Add gross negligence, data breach, IP infringement and breach of law No carve-outs (Illumina, Plaid) Data, Forms, Filings
Consequential-damages waiver Mutual waiver, including lost profits. Almost 99% of negotiated agreements that limit damages bar one or more forms of indirect damages Waiver with exceptions for the same uncapped claims, and breach-response costs deemed direct Waiver that also bars direct data loss and lost profits (Plaid) Data, Filings
Gross negligence, willful misconduct, fraud Express exception (Common Paper 8.4) Express exception, with a definition that avoids a narrow "willful" reading Silent, leaving only the common-law backstop Forms, Filings
Survival and notice Not benchmarked in the sources I found n/a n/a Gap. Bonterms lists Section 16 as surviving termination
Exclusive remedy Used for warranty and IP indemnity, not for the cap itself. Bonterms: warranty fix procedures are the exclusive remedies for performance warranty breach Exclusive remedy limited to non-material breaches Service credits as sole remedy (not found in the sampled exhibits) Forms

Two observations. First, the data point that matters most to your negotiating position is that negotiated agreements land squarely on the vendor's side, with almost 93% containing a cap. Asking for no cap is a position to trade away, not a realistic end state. Second, the World Commerce & Contracting 2024 survey of 937 organizations ranks limitation of liability first among most-negotiated terms, so vendors expect a request here.

KEY TAKEAWAY: Twelve months of fees is the anchor; the real negotiation is over the super-cap multiple and the carve-out list.

Variants With Sample Language

Observed EDGAR exhibits

Quotes below are copied from the exhibit text. "Filed" is the EDGAR filing date; "dated" is the agreement date.

Filer and exhibit Counterparty Dates Cap and carve-outs (summary) Law
RxSight, Inc., S-1, EX-10.10 Cloud Services Agreement QAD Inc. (vendor) Dated 28 May 2021; filed 9 July 2021 Mutual, 12 calendar months' fees under the order; carve-outs for death or injury, confidentiality (only if gross negligence or willful), IP indemnity California
Workiva, S-1, EX-10.10 Google Cloud Platform order form Google Inc. (vendor) Order form signed July 2014; filed 17 October 2014 (older than ten years) Mutual, amount paid in prior 12 months; confidentiality, IP violations and indemnities uncapped California
CoreWeave, S-1, EX-10.23 Master Services Agreement Microsoft (customer) Filed 3 March 2025; agreement date not captured Two-tier cap; cap periods appear in square brackets in the filed copy; gross negligence and willful misconduct uncapped. Infrastructure compute, not application SaaS New York
GenEmbryomics, F-1/A, EX-10.3 Illumina Software Subscription Agreement Illumina (vendor) Online form last updated 3 September 2024; filed 17 March 2025 Vendor-only; greater of 12 months' fees for the service or $1,000; no carve-outs California
Plaid, Reg A, MSA exhibit (an EX1A-6 exhibit, not an EX-10) Plaid (vendor) Online form last updated 27 November 2023; filing date not verified Vendor-only; 6 months per order, $100 floor; no carve-outs California
XMax, 8-K, EX-10.1 Cloud Services Agreement SuperX AI Technology USA (service provider; relies on upstream cloud suppliers) Dated 22 April 2026; filed 28 April 2026 3 months' fees; fraud, willful breach and payment duties outside the cap Nevada
CarbonMeta, 10-K, EX-10.96 SaaS Agreement Gulp Data, Inc. (vendor) Dated 17 August 2022; filed 20 April 2023 Vendor-only; fees paid, no time window; $5,000-scale deal Delaware

Pattern from these 7 filings: all have a fee-based cap; 4 are mutual or near-mutual and 3 are vendor-only; 4 have carve-outs (3 for confidentiality, IP or injury; XMax's are narrower: fraud, willful breach, payment duties); only 1 (CoreWeave) has a tiered super-cap. This is a small, hand-picked sample (the strongest are filed by the customers of large vendors), so treat counts as illustration, not statistics.

Customer-friendly variants

Bonterms-style enhanced cap with a broad uncapped list. From the Bonterms Cloud Terms v1.0 (© 2022, CC BY 4.0): "'Enhanced Cap' means three times (3x) the General Cap." and "'Uncapped Claims' means (a) the indemnifying party's obligations under Section 17 (Indemnification), (b) either party's infringement or misappropriation of the other party's intellectual property rights, (c) any breach of Section 18 (Confidentiality), excluding breaches related to Customer Data and (d) liabilities that cannot be limited by Law." It favors the customer because security and DPA breaches get 3x and indemnities are uncapped, though Customer Data confidentiality breaches fall under the general cap (or the enhanced cap only if they are also security or DPA breaches), not uncapped.

CoreWeave/Microsoft (customer is a large buyer). From EX-10.23: "EXCEPT FOR EITHER PARTY'S WILLFUL MISCONDUCT, GROSS NEGLIGENCE OR OBLIGATIONS UNDER SECTION 9(A)Y OR 9(B)(i) (INFRINGEMENT INDEMNIFICATION), OR EITHER PARTY'S BREACH OF SECTIONS 6 (CONFIDENTIALITY), IN NO EVENT SHALL THE AGGREGATE LIABILITY OF EACH PARTY ... EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER IN THE [SIX MONTHS] PRECEDING THE EVENT GIVING RISE TO THE CLAIM". The consequential-damages section adds that "FINES OR SETTLEMENT AMOUNTS OWED TO A STATE OR FEDERAL GOVERNMENTAL AGENCY, THE COST OF NOTIFICATIONS TO INDIVIDUALS OR GOVERNMENT AGENCIES, CREDIT MONITORING AND/OR IDENTITY THEFT INSURANCE FOR AFFECTED INDIVIDUALS FOR A PERIOD NOT TO EXCEED ONE YEAR" are "DEEMED 'DIRECT DAMAGES'". It favors the customer through the uncapped list and the deemed-direct breach costs, but the general cap is low (bracketed six months) and this is a negotiated deal with a very large buyer.

Neutral variants

Common Paper CSA v3.0, Section 8 (from the raw GitHub text, CC BY 4.0): "8.1 Liability Cap. Except as provided in the Cover Page, each party's total cumulative liability for all claims arising out of or relating to this Agreement will not be more than the General Cap Amount." and "8.4 Exceptions. Nothing in this Agreement will limit, exclude, or restrict a party's liability (a) to the extent prohibited by Applicable Laws, or (b) for its gross negligence, willful misconduct, or fraud." It is neutral by design: the README says it was created by a committee of over 40 attorneys representing vendors, procurement teams, boutique firms and Big Law. Its Section 8.1 itself has no indemnity or confidentiality carve-out unless the cover page adds one; the help article says the default is not to include any Increased or Unlimited Claims.

QAD/RxSight (mutual, moderate carve-outs). From EX-10.10: "A PARTY'S MAXIMUM LIABILITY FOR ANY DAMAGES ARISING OUT OF OR RELATED TO THE AGREEMENT OR THE SERVICES ... SHALL BE LIMITED TO THE AMOUNT OF THE FEES CUSTOMER PAID TO VENDOR OVER THE PREVIOUS TWELVE CALENDAR MONTHS UNDER THE ORDER DOCUMENT OR WORK ORDER GIVING RISE TO THE LIABILITY". The carve-outs are death or personal injury, confidentiality breaches "CAUSED BY A PARTY'S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT", and IP indemnities. It is mutual but ties the cap to the single order, which lowers the number for a customer with several orders.

Vendor-friendly variants

Illumina (vendor-only cap, no carve-outs). From EX-10.3: "THE CUMULATIVE LIABILITY OF ILLUMINA FOR ALL CLAIMS ARISING FROM OR RELATING TO THIS AGREEMENT ... SHALL NOT EXCEED THE GREATER OF: THE TOTAL FEES PAID BY CUSTOMER TO ILLUMINA FOR THE SERVICE GIVING RISE TO SUCH LIABILITY DURING THE PREVIOUS TWELVE (12) MONTHS BEFORE THE CLAIM, OR ONE THOUSAND DOLLARS (USD $1,000)." The same section excludes "LOSS OF OR CORRUPTION OR DAMAGE TO DATA", so a data-loss claim has no recovery path.

Plaid (short window, direct data loss excluded). From the Plaid MSA: "PLAID'S AGGREGATE LIABILITY IN CONNECTION WITH EACH ORDER ... WILL NOT EXCEED THE AMOUNT PAID OR PAYABLE BY CLIENT TO PLAID DURING THE SIX (6) MONTH PERIOD PRIOR TO THE EVENT GIVING RISE TO LIABILITY (PROVIDED THAT, IF NO FEES ARE PAID OR PAYABLE, SUCH AMOUNTS WILL BE LIMITED TO ONE HUNDRED DOLLARS (US$100.00))." It also bars "LOSS, ERROR, OR INTERRUPTION OF USE OR DATA (IN EACH CASE, WHETHER DIRECT OR INDIRECT)".

Salesforce 2008 (historical baseline only). The 2008 Salesforce terms (EX-10.28, filed 2008, California law) read: "IN NO EVENT SHALL EITHER PARTY'S AGGREGATE LIABILITY EXCEED THE AMOUNTS ACTUALLY PAID BY AND/OR DUE FROM YOU IN THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO SUCH CLAIM." It has no carve-outs. It shows the 12-month anchor is long-standing, but it is far older than the ten-year window and I do not use it in the tallies.

KEY TAKEAWAY: Customer-favorable paper in the record comes from large buyers (Microsoft) or neutral committee forms; small-vendor click-through terms are the most one-sided.

Jurisdiction Notes: New York Enforces Commercial Caps, but Write the Carve-Outs In

I found no New York appellate decision applying a SaaS or cloud subscription cap (see gaps). The points below come from cases in other commercial settings, so applying them to SaaS is my inference.

Fallback Positions (Customer Side, Strongest Ask to Last Concession)

This ladder is my inference from the evidence above, not an observed sequence. Each step assumes the previous ask was refused.

  1. Open: mutual cap at 12 months' fees "paid or payable", or higher; uncapped claims for indemnities, confidentiality, IP, fraud, gross negligence and willful misconduct. This matches the Common Paper and Bonterms defaults and the QAD/Google exhibits. You give up nothing yet. Expect the vendor to resist uncapped confidentiality and to ask for a super-cap instead.
  2. Move data, security and privacy claims to a super-cap of 5x (or at least 3x) the general cap. Common Paper offers 5x as its optional Increased Cap Amount; Bonterms uses 3x. You give up uncapped data-breach liability. In exchange, ask for the vendor to accept the super-cap without a separate, lower sub-limit for each breach type.
  3. Accept a lower super-cap multiple (2x to 3x), but fix the base. One vendor-side practitioner puts super-caps at commonly 2x to 5x. You give up multiple. Ask for the base to be "greater of fees paid or payable in 12 months or a fixed dollar floor", so early-term claims are not capped near zero. The Illumina and Plaid forms show a floor of $1,000 and $100, which is far too low to copy; set one that reflects realistic breach cost.
  4. Narrow uncapped confidentiality to gross negligence or willful breach. This is the QAD structure. You give up uncapped liability for ordinary confidentiality breaches. In exchange, keep indemnities for third-party claims and data-protection law breaches inside the super-cap, not the general cap.
  5. Make the consequential-damages waiver mutual and deem breach-response costs direct. Use the CoreWeave approach: notification, credit monitoring and regulatory fines are deemed direct damages. You give up lost-profit recovery. In exchange, breach-response costs count against the super-cap rather than being excluded.
  6. Last acceptable concession: a plain 12-month mutual cap with express carve-outs for gross negligence, willful misconduct and fraud only. This is the Common Paper 8.4 position. You give up the data super-cap and the indemnity carve-outs, so check the vendor's insurance, security terms and indemnity wording instead. Keep the express gross-negligence carve-out even if you give up everything else, because after Part 60 a non-nominal cap may otherwise stand against such a claim in a pure contract case.

Items to avoid at any step: a vendor-only cap, a cap tied to a single order when you buy several, and a data-loss exclusion like Illumina's.

Evidence Gaps and Caveats

Sources