Compliance

Indemnification Clause

An indemnification clause is a contractual allocation of risk under which one party (the indemnitor) agrees to defend, hold harmless, and reimburse the other party (the indemnitee) for specified categories of losses arising from third-party claims, typically including IP infringement, breach of confidentiality, and breach of law.

Two professionals reviewing contract risk-allocation language

What Is an Indemnification Clause?

An indemnification clause is a risk-shifting provision in a commercial contract. It says that if a defined category of harm comes through the door (typically a third-party claim), one party (the indemnitor) will pay the cost and absorb the loss so the other party (the indemnitee) does not. Indemnification is one of the most negotiated clauses in any US services contract because it is where money actually moves when something goes wrong.

The clause typically combines three obligations: a duty to defend (run the legal defence of the third-party claim), a duty to indemnify (reimburse the loss), and an undertaking to hold harmless (ensure the indemnitee is made whole). The Restatement (Second) of Contracts treats indemnification as a freely allocable risk between contracting parties, and US courts will generally enforce indemnity clauses as written subject to public-policy limits (you cannot indemnify intentional torts or, in some states, your own sole negligence without explicit language).

Mutual vs. One-Way

A one-way indemnity runs in a single direction. The customer wants the contractor to indemnify it for infringement and breach, but the customer does not promise the same in return. One-way indemnities are common where one party has significantly greater leverage (large customer engaging small vendor) but are increasingly disfavoured as a default.

A mutual indemnity runs both ways. Each party indemnifies the other for losses caused by its own breach or wrongdoing. This is the fairer construction and the dominant pattern in most US services agreements between roughly comparable counterparties. The standard formulation is something like: “Each party shall indemnify the other from third-party claims arising from the indemnifying party’s breach of this Agreement, negligence, or willful misconduct.”

Mutuality does not necessarily mean symmetry. Mutual clauses often have asymmetric carve-outs: the customer’s indemnity might cover its provision of harmful inputs or data, while the contractor’s indemnity covers its work product. Both directions exist but each direction is shaped by the risk that party actually controls.

Typical Scope

The categories that most US services contracts include in some form:

IP infringement. Almost universal. The contractor indemnifies the customer for third-party claims that the contractor’s work product infringes copyright, patent, trademark, or trade-secret rights. This is the headline indemnity in services contracts because IP litigation is expensive and the contractor is in the best position to know whether its code is clean.

Breach of confidentiality. Either side may indemnify the other for losses caused by leaking confidential information.

Breach of applicable law. Each party indemnifies the other for losses caused by the indemnifying party’s violation of applicable law, including data-protection law, export-control law, anti-corruption law, and employment law.

Bodily injury and property damage. Where contractors have personnel on customer premises, the contractor typically indemnifies the customer for injury or property damage caused by its personnel (and the customer indemnifies the contractor for the reverse).

Data incidents. With the rise of data-protection law, breach of data-protection obligations is increasingly carved out as a separate, often uncapped, indemnity category.

A safer drafting pattern ties each category to third-party claims “to the extent caused by” the indemnifying party’s breach or fault, rather than as a blanket assumption of all losses. This prevents the indemnity from sweeping in losses the indemnifying party did not actually cause.

Caps and Exclusions

Indemnity exposure is usually framed inside the limitation-of-liability clause. The standard pattern is:

Aggregate liability cap. Each party’s total liability under the contract is capped at one to two times fees paid in the preceding twelve months. This puts a floor under the contract’s commercial value but a ceiling on either side’s exposure.

Carve-outs from the cap. Specific high-severity categories are excluded from the cap and remain uncapped or capped at a higher multiple. The most common carve-outs are:

  • IP infringement indemnity (the contractor cannot benefit from a low cap if it shipped infringing code)
  • Breach of confidentiality
  • Gross negligence and willful misconduct
  • Breach of data-protection obligations
  • Indemnity for bodily injury
  • Fraud
  • Payment obligations (unpaid fees, which are not really “damages”)

This two-layer structure (general cap with explicit carve-outs) is the dominant pattern in US commercial contracts. It lets the parties price risk for routine breaches while preserving full recovery for the rare catastrophic events.

Procedural conditions. Indemnity clauses typically require the indemnitee to give prompt notice of a claim, allow the indemnitor to control the defence (with counsel of its choice), and cooperate in the defence. Failure to comply usually reduces or eliminates the indemnity to the extent of any prejudice caused.

Where Omnivoo Helps

Omnivoo’s Contract Management templates ship with a market-standard mutual indemnification clause covering IP infringement, breach of confidentiality, breach of law, and willful misconduct, paired with a tiered limitation-of-liability cap and explicit carve-outs for the high-severity categories. US customers running global contractor engagements can apply consistent risk allocation across every SOW without rebuilding the indemnity stack each time, which is the operational benefit of the MSA + SOW model.

Frequently asked questions

What is the difference between mutual and one-way indemnification?
A one-way indemnity runs in a single direction: one party indemnifies the other but not vice versa. Vendors typically resist one-way indemnities running against them. A mutual indemnity runs both ways: each party indemnifies the other for losses caused by its own breach, negligence, or misconduct. Mutual indemnity is the fairer default and is the dominant pattern in US services contracts between roughly equal counterparties.
What categories does an indemnification clause usually cover?
The most common categories are: third-party intellectual property infringement claims arising from the indemnitor's work product, breach of confidentiality, breach of applicable law, bodily injury and property damage caused by the indemnitor's employees or agents, breach of data-protection obligations, and gross negligence or willful misconduct. The exact list is heavily negotiated and should match the actual risk profile of the engagement.
What are typical caps and carve-outs?
Most US services contracts cap aggregate liability at one to two times the fees paid in the preceding twelve months. Indemnity obligations are often carved out from the cap (so they remain uncapped) for IP infringement, breach of confidentiality, gross negligence, and willful misconduct. Bodily injury, fraud, and breach of law are also commonly carved out. The result is that ordinary contract breaches are capped but the high-severity risks remain fully covered.
What does "defend, indemnify, and hold harmless" mean?
These are three distinct obligations bundled into one clause. "Defend" means the indemnitor must take over the legal defence of the claim (or fund counsel for the indemnitee). "Indemnify" means the indemnitor must reimburse the indemnitee for losses, including damages awarded against them. "Hold harmless" means the indemnitor accepts responsibility for the loss so the indemnitee is not out of pocket. The exact scope is interpreted under the governing law of the contract, often by reference to the Restatement (Second) of Contracts.
Can a contractor refuse to indemnify the customer?
In principle yes, but in practice every US services contract of any size includes at least an IP-infringement indemnity from the contractor. A contractor who refuses to indemnify for IP infringement is essentially asking the customer to bear the risk that the contractor's code infringes a third party's patent or copyright. Most customers will not sign on that basis. The negotiation is usually about scope, caps, and procedural conditions, not whether the indemnity exists.

Related Terms

Compliance

Governing Law Clause

A governing law clause specifies which jurisdiction's substantive law applies to the interpretation and enforcement of a contract, and under the Restatement (Second) of Conflict of Laws section 187 US courts will generally honour the parties' choice provided the chosen state has a substantial relationship to the parties or the transaction and the choice does not violate a fundamental policy of a state with a materially greater interest.

Compliance

IP Assignment

An IP assignment is a contractual transfer of intellectual property rights (typically copyright, but also patent, trademark, or trade-secret rights) from the creator to another party, which under US copyright law requires a signed writing under 17 USC 204(a) to validly transfer copyright ownership.

Compliance

Master Service Agreement (MSA)

A Master Service Agreement (MSA) is a standing contract that establishes the legal and commercial framework between a customer and a service provider, governing all individual projects executed under it through subsequent Statements of Work.

Compliance

Severability Clause

A severability clause is a contractual provision stating that if any single term of the contract is held invalid or unenforceable, the remaining terms continue in full force and effect, and in many states the unenforceable term is either struck out (blue-pencil approach) or judicially reformed to the maximum extent legally permissible.

Compliance

Work-for-Hire

Work-for-hire is a US copyright doctrine under 17 USC 101 in which the copyright in a work vests originally in the hiring party rather than the human author, but it applies only to works prepared by an employee within the scope of employment or to commissioned works in nine specifically enumerated categories agreed in writing.

Related articles

Omnivoo handles this for you

Stop worrying about Indian payroll and compliance terms. Omnivoo manages everything (PF, ESI, TDS, professional tax, and more) across all 28 states.

Get started