In plain English
An indemnity clause says who pays (and often who defends) if a third party sues over something tied to the deal. Startups should map indemnity to risks each side controls (IP, data, misuse), keep procedures clear, and read it next to the liability cap. Broad "any and all claims" language is a fight, not a favor.
Not legal advice. Escalate material indemnity risk to a licensed attorney.
By version90 staff Published Updated How this was made
Indemnity in one sentence (then the messy reality)
Indemnify roughly means: if someone outside the contract comes after Party A because of Party B's mess, Party B covers Party A's losses (and often the lawyers).
In SaaS and services MSAs, that "mess" is usually:
- IP infringement claims about what you delivered
- Data breach / privacy claims
- Bodily injury / property damage (less common in pure software)
- Customer misuse, illegal content, or instructions you followed
If your negotiation still lives in OrderForm_FINAL_use_this_one.docx, indemnity is a favorite place for silent expansions. Track Changes exists for a reason.
Pair this guide with liability caps for startups and the Startup MSA redline checklist.
What is an indemnity clause?
| Piece | What to look for | Why ops cares |
|---|---|---|
| Trigger | Which claims / losses activate indemnity | Vague triggers = surprise invoices |
| Covered parties | Company, affiliates, officers, customers | Scope creep via "affiliates" |
| Defense | Who controls the lawsuit / settlement | You can be bound by a bad settlement |
| Notice | How fast you must tell the other side | Miss notice → fight over coverage |
| Exclusions | Negligence of indemnified party, etc. | Fairness valve |
| Cap interaction | Is indemnity inside or outside the liability cap? | Decides whether risk is actually bounded |
"Hold harmless" often travels with indemnity. Don't assume the phrase alone does the work, read the full section.
Mutual vs one-sided indemnity
One-sided indemnity (common in big-vendor or big-customer paper): only you indemnify them for a long list; they indemnify you for almost nothing.
Mutual indemnity (ops-friendly default ask): each side covers the risks it actually creates.
| Risk | Who usually indemnifies | Startup cue |
|---|---|---|
| Vendor IP infringement | Vendor / provider | Expect this on seller paper |
| Customer materials / instructions | Customer | Fair if you host their content |
| Data breach from provider systems | Provider (often via DPA + indemnity) | Check security exhibits |
| Misuse / unlawful use by customer | Customer | Narrow to misuse, not every claim |
| Personal injury on a site visit | Party that controls the site | Services / field work deals |
Redline cue: "Indemnify for any and all claims related to the Agreement" is not a clause. It's a hostage note. Push for listed claim types.
How indemnity connects to the liability cap
Read these sections as a pair:
- Does the limitation of liability apply to indemnity obligations?
- Are there separate caps for IP indemnity?
- Do consequential damages exclusions apply to indemnity?
A beautiful mutual indemnity that sits entirely outside an already-hollowed cap can recreate uncapped exposure. Details in the liability cap guide.
Procedure language worth fighting for
Founders skip procedure paragraphs. Finance regrets that later.
Aim for clarity on:
- Prompt notice of claims (define "prompt"; avoid traps that forfeit coverage for tiny delays)
- Control of defense by the indemnifying party, with a right to participate
- No settlement that admits fault or binds the indemnified party without consent
- Mitigation cooperation that is reasonable, not a full-time job
IP indemnity specifics
IP indemnity is where product companies live or die in negotiation:
- Seller perspective: Offer indemnity for claims that your product, as delivered, infringes; exclude customer modifications, combinations, and use after you said stop.
- Buyer perspective: Want coverage for the tools you're paying for; watch exclusions that swallow the promise.
- Open source: If your stack is OSS-heavy, say so honestly in exhibits, don't let marketing invent patent theater.
Data and confidentiality indemnity
If personal data or customer content is in play:
- Confirm whether indemnity lives in the MSA, the DPA, or both
- Align breach notification timing with what you can operationally hit
- Avoid double indemnity that conflicts across documents, check order of precedence
For a full vendor pass, use the vendor contract review checklist.
Word redline workflow (so the clause stays the clause)
- Open the latest
.docx. - Search indemnify, indemnification, hold harmless, defend.
- Diff against last agreed draft, watch for "related to" expansions.
- Comment in Track Changes; don't paste a clean PDF back into the thread.
- Keep one canonical version in shared history, not seven finals.
Walk-away / escalate signals
- Unlimited indemnity for "any claim arising out of the relationship"
- You indemnify them for their IP and their security failures
- Indemnity clearly uncapped while every other remedy is tightly capped, and nobody can explain why
- Defense control with mandatory settlement rights that can admit your fault
- Conflicting indemnity in MSA vs DPA with no precedence rule
About this page
Who. Written by version90 staff at Latent Ape LLC, the company that builds version90, working with AI tools. We build contract software and run our own contracts through it; we are not a law firm, and nothing here is legal advice.
How. Each piece starts from the review workflow version90 is built around. AI drafts and structures the text; staff edit, fact-check, and rewrite it before it is published, and we update the date shown above whenever the substance changes.
Why. The library exists to give founders and ops teams a shared standard for reviewing contracts without a legal department. If you spot an error, email [email protected] and we will fix the page.