How To Cap Liability In Your SaaS Terms

Yes, you can usually cap your liability in your SaaS terms - and you should. A well-drafted limitation of liability clause can stop one customer dispute from becoming a business-threatening claim.

But the clause can't do everything. Some rights under Australian law can't simply be contracted out of, and a cap that feels too one-sided may create problems under the Australian Consumer Law.

For SaaS startups, the trick is to make the cap commercially sensible and legally defensible. That means thinking carefully about downtime, data loss, integrations, security issues and whether subscription fees are the right benchmark for your cap.

What Is A Limitation Of Liability Clause In A SaaS Contract?

A limitation of liability clause is a contract term that limits how much your business may have to pay if something goes wrong with your SaaS product.

In a SaaS agreement, this clause usually sits in your SaaS terms and conditions, master services agreement, order form or online terms of use. It often works together with other clauses, such as your warranties, service levels, support commitments, indemnities and privacy terms.

A typical software terms limitation of liability clause might deal with:

• A liability cap: for example, your maximum liability is capped at the fees paid by the customer in the previous 12 months.
• Types of loss you exclude: for example, lost profits, lost revenue, loss of goodwill or indirect losses.
• Carve-outs: claims that aren't capped, or have a higher cap, such as unpaid fees, confidentiality breaches or intellectual property infringement claims.
• Australian Consumer Law wording: wording that recognises the clause can't override rights that can't be excluded by law.

Say Maya runs a project management SaaS platform for tradies. One customer pays $3,000 a year. If a bug causes that customer to miss a tender deadline, the customer might try to claim the value of the lost tender. Without a sensible liability cap, Maya may be exposed to a claim far larger than the subscription fee she received.

That doesn't mean Maya can ignore her obligations or provide an unreliable product. It just means her contract should draw a fair line around the risk she's prepared to take on for the price she's charging.

Can You Cap Liability In SaaS Terms In Australia?

Yes, you can cap liability in SaaS terms in Australia, but the cap needs to work within the limits of contract law and consumer protection laws.

For business customers, a liability cap is common and often expected. If you're selling to larger organisations, their procurement teams will usually look for the cap and may negotiate it heavily.

For smaller customers, your terms may be a standard form contract. That means the unfair contract terms regime under the Australian Consumer Law may apply. Since November 2023, unfair contract terms can attract significant penalties, not just be declared void.

For a small business contract, the regime can apply where at least one party has fewer than 100 employees or annual turnover of less than $10 million. It can also apply to consumer contracts. There's no longer an upfront contract value threshold for these protections.

A clause is more likely to be unfair if it:

• creates a significant imbalance between you and the customer
• isn't reasonably necessary to protect your legitimate business interests
• would cause detriment to the customer if you relied on it

This doesn't mean every liability cap is unfair. A balanced cap that reflects the price paid, the risks of the software and the insurance available to you is much easier to justify than a blanket clause saying you're never liable for anything, no matter what happens.

You also need to consider the Australian Consumer Law consumer guarantees. Depending on your customer and the nature of the services, guarantees may apply to your SaaS offering. You generally can't exclude non-excludable guarantees, although in some business-to-business cases you may be able to limit remedies to supplying the services again or paying the cost of having them supplied again, if the law allows it and the limitation is fair and reasonable.

What Is A Reasonable SaaS Liability Cap?

A reasonable SaaS liability cap is usually linked to the fees the customer has paid, but the right number depends on your product, customers and risk profile.

For many SaaS startups, a common benchmark is:

• the fees paid by the customer in the previous 12 months
• the fees paid under the relevant order form
• a fixed dollar amount, especially for free or low-cost plans
• a higher cap for specific risks, such as data breaches or confidentiality breaches

The 12-month subscription fee model is popular because it links your risk to your revenue from that customer. If a customer pays $1,200 per year, it may be commercially unrealistic for you to accept uncapped exposure to millions of dollars in downstream losses.

That said, a 12-month fee cap may not always be enough. If you handle sensitive personal information, payments data, health information or critical business workflows, customers may expect a higher cap for certain claims.

Common Cap Structures

You might consider one of these structures:

• Single cap: one cap applies to most claims. This is simple, but may be too blunt for enterprise customers.
• Tiered cap: general claims are capped at 12 months of fees, while data security or confidentiality claims are capped at a higher amount.
• Plan-based cap: lower caps apply to free or starter plans, and higher caps apply to enterprise plans.
• Insurance-linked cap: some risks are capped by reference to your professional indemnity or cyber insurance cover, although you need to be careful not to promise cover you don't actually have.

If you're still early-stage, it can be tempting to accept uncapped liability to close a big customer. Be careful with this. A single enterprise deal can be exciting, but if the contract risk is disproportionate, it may make the business harder to insure, fundraise for or sell later.

Can You Exclude Consequential Loss In A SaaS Contract?

Yes, you can often exclude consequential loss in a SaaS contract, but the wording needs to be clear because the phrase can be uncertain.

Many SaaS contracts say neither party is liable for consequential loss. The problem is that people don't always agree on what consequential loss means. If the clause doesn't define it properly, you may end up arguing about the phrase instead of resolving the issue.

For SaaS, you may want to be more specific and exclude categories such as:

• loss of profits
• loss of revenue
• loss of anticipated savings
• loss of business opportunity
• loss of goodwill or reputation
• loss caused by third-party systems or integrations outside your control
• loss of data, except where you've agreed to specific backup or recovery obligations

You should also think about whether the exclusion applies to both parties. For example, you may not want the customer to exclude all consequential loss if they misuse your intellectual property, breach confidentiality or fail to pay fees.

Some customers will push back if the exclusion is too broad. A practical compromise is to exclude indirect and speculative losses, while keeping responsibility for direct losses within the agreed liability cap.

What SaaS Risks Should Your Clause Deal With?

Your clause should deal with the risks that are specific to how your SaaS product works, not just generic contract risks.

A limitation of liability clause copied from general business terms and conditions may miss key SaaS issues. Templates can be a useful starting point, but SaaS terms work best when they're tailored to your product, customer base and delivery model.

Downtime And Service Availability

Downtime is one of the biggest SaaS risks because your customer is paying for access. If your platform is unavailable, your customer may lose productivity, sales or customer trust.

Your contract should be clear about:

• whether you provide a service level commitment
• planned maintenance windows
• what happens during emergency maintenance
• whether service credits are the customer's only remedy for downtime
• events outside your control, such as hosting provider outages

If you offer service credits, make sure they're commercially manageable. A credit is usually safer than promising to compensate every downstream loss a customer says they suffered during an outage.

Data Loss And Backups

Data loss can be more serious than a temporary outage. If customers store records, projects, files or reports in your platform, you need clear rules about backups and recovery.

Your terms should explain:

• what data you store and for how long
• whether customers are responsible for keeping their own backups
• your recovery commitments, if any
• what happens when a customer deletes data by mistake
• what happens when an account is suspended or terminated

If you handle personal information, the Privacy Act 1988 may also be relevant. Many SaaS providers need a privacy policy and internal processes for handling personal information. If you're covered by the Notifiable Data Breaches scheme, eligible data breaches must be notified to affected individuals and the Office of the Australian Information Commissioner.

Integrations And Third-Party Platforms

Integrations are useful, but they create messy responsibility questions. If your product connects to Xero, Shopify, Stripe, Google, Microsoft or another third-party platform, your service may depend on systems you don't control.

Your terms should make clear that you're not responsible for failures caused by third-party platforms, API changes, customer configuration errors or revoked permissions, unless you've specifically agreed otherwise.

This is especially important if your software automates business-critical tasks. If a third-party integration stops working and orders don't sync properly, the customer may look to you first, even if the root cause sits elsewhere.

Customer Misuse And Security Settings

Many SaaS disputes come from how the customer uses the product. Your limitation clause should work alongside obligations requiring customers to manage users, passwords, permissions and data entry carefully.

For example, if a customer gives admin access to too many staff or ignores two-factor authentication, you don't want to be fully responsible for losses that could have been avoided through basic account security.

What Should Be Carved Out Of The Liability Cap?

Some claims should sit outside the liability cap or have their own higher cap, depending on the deal.

Carve-outs are important because they stop your cap from creating unfair or commercially odd results. They also make your terms more acceptable to customers, especially larger ones.

Common carve-outs include:

• Payment obligations: customers shouldn't be able to use the cap to avoid paying subscription fees.
• Confidentiality breaches: confidential information can be highly valuable, so parties often treat this separately.
• Intellectual property infringement: if you promise your software doesn't infringe someone else's IP, customers may ask for stronger protection.
• Privacy and data security breaches: these may need a higher cap, especially where sensitive information is involved.
• Wilful misconduct or fraud: parties usually don't expect these to be capped.
• Non-excludable rights: your clause should recognise that some liability can't be excluded under law.

From your perspective, you don't need to accept every carve-out a customer requests. The right position depends on the value of the contract, your insurance, the customer data involved and how much control you have over the risk.

For example, if your SaaS product is a simple scheduling tool and the customer stores minimal personal information, a high uncapped privacy carve-out may be disproportionate. If you're storing health information for clinics, the conversation will be different.

How Should You Negotiate A Liability Cap With Customers?

You should negotiate a liability cap by linking it to the commercial deal, the actual risk and the level of control each party has.

When a customer asks for a higher cap, whether in heads of terms or the final contract, try not to treat it as a purely legal debate. Ask what risk they're worried about. Their concern may be downtime, data loss, privacy, IP infringement or internal procurement policy.

Practical Negotiation Options

Here are some options that often work better than simply saying yes or no:

• increase the cap only for specific claims, rather than all claims
• offer service credits for downtime instead of broad damages
• tie the cap to 12 or 24 months of fees, rather than uncapped liability
• set a fixed dollar cap for enterprise plans
• exclude losses caused by customer misuse, incorrect data or third-party integrations
• match higher risk with higher pricing, if the customer wants stronger commitments

If a customer wants unlimited liability, ask whether the customer contract value supports that level of risk. It's reasonable to explain that your pricing is based on a capped-risk model. If they want you to take on more risk, the commercial terms may need to change too.

You should also check your insurance before agreeing to higher caps. Professional indemnity, cyber and technology liability policies all work differently. A contract cap won't guarantee your insurer will cover the claim, and your insurance policy may have exclusions, sub-limits and notification requirements.

Common Mistakes To Avoid

A few common mistakes can make a SaaS liability clause harder to rely on or harder to negotiate.

• Using a blanket exclusion of all liability: this can look unreasonable, especially for standard form contracts and smaller customers.
• Forgetting the Australian Consumer Law: your terms shouldn't pretend to exclude rights that can't be excluded.
• Leaving consequential loss undefined: vague wording can create uncertainty and disputes.
• Using the same cap for every risk: privacy, confidentiality and IP risks may need different treatment.
• Ignoring service levels: if you promise 99.9% uptime in sales materials but your contract says nothing meaningful about downtime, expectations may clash.
• Not aligning with your privacy and security documents: your customer terms, privacy policy, data processing terms and security practices should tell a consistent story.
• Accepting customer paper without review: enterprise customer contracts often include uncapped indemnities, broad warranties and strict service credits.

It's also worth reviewing your clause as your SaaS product grows. A cap that made sense when you had a basic MVP and ten small customers may not fit once you're serving regulated industries, larger teams or international users.

Key Takeaways

• You can usually use a limitation of liability clause in your SaaS terms, but it needs to fit Australian law and the way your product actually works.
• A common SaaS liability cap is the fees paid in the previous 12 months, but higher caps may be needed for privacy, confidentiality or IP risks.
• Excluding consequential loss can help, but clear wording is better than relying on a vague phrase.
• Your clause should address SaaS-specific risks like downtime, data loss, integrations, customer misuse and subscription-based pricing.
• Australian Consumer Law protections, including unfair contract terms and non-excludable consumer guarantees, can affect how far your clause can go.
• Negotiating caps is easier when you connect the legal risk to the contract value, your insurance and the customer's real concern.

If you'd like help with your SaaS customer terms, liability cap wording, data and privacy clauses or contract negotiations, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.