Indemnification clauses: who actually pays when things go wrong

Most contract clauses govern what happens between you and the other party. Indemnification governs what happens when somebody else sues — a customer, a regulator, a patent holder — and the two of you have to decide in advance whose problem that is.

It's the clause with the widest gap between how routine it looks and how much money it can move.

The three words, and why they aren't synonyms

"Defend, indemnify, and hold harmless" reads like lawyerly throat-clearing. It isn't; each word does distinct work, and the differences show up in timing and control.

The practical distinction is defend. An indemnity without a defense obligation means you hire the lawyers, you run the case, you front every invoice for two years, and you seek reimbursement at the end — if the indemnifying party is still solvent and still agrees the claim was covered.

The ask: if a party is indemnifying you, get an express duty to defend, not merely to indemnify.

The standard shape

In a typical software or services agreement, the indemnities divide along lines of control — each party indemnifies for the risks it is actually in a position to manage.

The vendor typically indemnifies the customer for:

• IP infringement — claims that the service or deliverables infringe a third party's patent, copyright, trademark, or trade secret.
• Breach of its own confidentiality or data protection obligations.
• Its own violation of applicable law.

The customer typically indemnifies the vendor for:

• The content and data the customer puts into the service, including claims that it infringes third-party rights or violates law.
• Use of the service in breach of the agreement or the acceptable use policy.

That division is the one to measure a proposed clause against. Symmetry for its own sake is not the goal — an indemnity should track the risk each side controls. What is worth challenging is an indemnity that makes you responsible for something you have no ability to prevent.

The IP infringement indemnity, in detail

This is the one that matters most when you're buying, because you cannot inspect a vendor's IP position and you're the one whose business stops if an injunction lands.

A complete version has three parts:

1. Defense and indemnity for third-party infringement claims arising from the service.
2. Remedies if an injunction is threatened or granted — the vendor will, at its option and expense, procure the right for you to continue using the service, replace or modify it to be non-infringing, or terminate and refund prepaid fees.
3. Exclusions — no indemnity where the claim arises from your modifications, your combination of the service with something else, or your use in breach of the agreement.

The exclusions are reasonable in principle and often too broad in practice. "Combination with any other product, software, or data" describes normal use of essentially any API. Narrow it to combinations the vendor did not contemplate or authorize.

Watch the refund remedy too. "Terminate and refund the prepaid fees for the unused portion of the term" is a small cheque next to the cost of ripping out a system you have built on.

Control of the defense

If someone else is paying for the defense, they generally want to run it. That's fair — but running it includes deciding whether to settle, and a settlement can include admissions or obligations that affect you.

A balanced control clause covers four things:

• Notice. The protected party must give prompt written notice of the claim. Check whether failure to give notice voids the indemnity entirely, or only reduces it to the extent the delay actually caused prejudice. The second is the fair version.
• Control. The indemnifying party controls the defense and selects counsel.
• Consent to settle. No settlement that admits fault on your behalf, or imposes any non-monetary obligation on you, without your consent.
• Participation. You may participate at your own expense with your own counsel.

Also check for a duty to cooperate — it's normal, and it should be at the indemnifying party's expense.

Where indemnities meet the liability cap

This is the interaction founders most often miss, and it can quietly undo the whole clause.

If indemnification obligations sit inside the general liability cap, then a vendor indemnifying you for a patent claim owes you, at most, twelve months of fees — which is unlikely to cover the defense costs alone. The indemnity looks robust and is bounded by a number set elsewhere in the document.

Three common resolutions:

• Uncapped indemnity — the customer's preferred position, particularly for IP infringement.
• Supercapped — a higher ceiling for indemnity claims, commonly a multiple of annual fees. This is where most negotiations land.
• Inside the general cap — the vendor's preferred position, and worth challenging where the exposure is real.

Equally important: check that the exclusion of consequential damages doesn't swallow the indemnity. Third-party judgments and settlement amounts can be argued to be indirect damages. Well-drafted contracts say expressly that the damages exclusion does not apply to indemnification obligations. The mechanics of caps, exclusions and carve-outs are covered in limitation of liability, explained.

Reading an indemnity in five questions

1. Who indemnifies whom, and for which claims? Map every indemnity in the document, not just the one labelled "Indemnification."
2. Is there a duty to defend, or only to indemnify?
3. What are the exclusions, and do they describe how I actually use this?
4. Who controls the defense, and can they settle without my consent?
5. Is the indemnity capped — and by which cap?

Question 5 is where the money is. An uncapped-looking indemnity subject to a 12-month fee cap is a different clause from the one you thought you read.

Related reading

For the cap that constrains all of this, see limitation of liability, explained. For where indemnities sit in a full first-pass review, see how to review a contract without a lawyer. For the other patterns we flag in vendor paper, five clauses we always flag in vendor MSAs.

A disclaimer

This describes how indemnification clauses are commonly structured in commercial agreements. It is not legal advice and creates no lawyer–client relationship. Indemnity law differs meaningfully between jurisdictions — including on whether an indemnity covers a party's own negligence, and what language is required to make it do so. Take the clauses that carry real money to a lawyer.