Indemnity Clause Review Checklist Before You Sign

You are one signature from a vendor MSA — a master services agreement vendors hang order forms on — and you treated indemnify, defend and hold harmless as boilerplate beside the cap you already skimmed. Write who pays whom, name the trigger, circle defend versus indemnify, log how it stacks with the cap, then keep, narrow, or escalate — do not trust a mutual heading.

In August 2026, Rafael — ops at a 28-person UK fintech — is buying a data-enrichment vendor that will hold customer records. Counsel is in a board pack until Monday. Section 11 looks mutual: vendor IP is subject to Section 12; his paragraph is any and all claims arising out of Customer’s use, including affiliates, with no cap cross-reference. A typical mistake: believing the heading. In practice a vendor claim in month two is last month’s invoice; a use claim on his side has no ceiling — and defend means he funds counsel — a qualified lawyer — on the complaint.

Disclaimer: Checkory provides AI support, not legal advice. Consult a qualified lawyer for binding decisions.

What does indemnity ask you to pay for?

An indemnity is a primary promise to pay, not a heading next to the cap. Indemnify, defend, and hold harmless are three cash moments. Indemnify waits for a finding or settlement. Defend starts when a claim is asserted that is potentially covered. Hold harmless can widen the losses you fund.

Freeze the packet — the exact file set that will be signed: MSA, order form, DPA — a data processing agreement — and today’s online terms. Ookulli: a UK B2B indemnity has no statutory ceiling, and a cap elsewhere does not automatically cover it. UCTA 1977 s.4 controlled consumer indemnities; CRA 2015 repealed it for business-to-business paper. ReviewMyContract splits the bill into damages, defense costs, and settlements. A dismissed claim can still cost hundreds of thousands to defend.

• Do: treat the three words as a bill.
• Do not: skim them as filler.

Which trigger should you write down: breach, third-party, IP, or data?

Write the actual trigger, not “if something goes wrong.” Damages need breach, causation, remoteness, and mitigation. A wide indemnity can skip those hurdles. Name third-party IP in the Service, vendor security failure, customer content or misuse, a defined breach, or a catch-all arising out of use.

Sprintlaw UK (1 May 2026) flags in connection with and arising out of. Harvey notes arising out of sweeps farther than caused by. ReviewMyContract splits SaaS into vendor IP, data-breach, and customer-content — do not accept one clause for all three. Prefer caused by.

• Do: write one trigger per direction.
• Do not: accept related to as market.

When is mutual indemnity one-way in substance?

Mutual means both sides have an obligation, not the same one. The honest SaaS default is a one-way vendor IP indemnity — the vendor is the cheapest cost avoider for the code. Cosmetic mutuality: vendor indemnifies IP in the Service; you indemnify any claim arising out of Customer’s use.

ContractHQ says compare scope, caps, and carve-outs both ways. Standard IP exclusions: combination and modification. ClauseScanner (March 2026): one-sided with no return, uncapped routine risk, and no notice are red flags. Mutual plus named categories is not. Rafael’s paper: vendor IP subject to the cap; customer use uncapped.

• Do: fill two columns and compare scope.
• Do not: treat the Mutual heading as even.

How does indemnity stack with the liability cap?

Open Limitation of Liability. Do not recompute the fees-paid number — that hunt lives in the MSA cap review. Log four states: inside the general cap, a named super-cap, expressly uncapped, or silent.

LegalClarity: if the cap covers all claims arising out of this agreement and the contract is silent, a court may put indemnification inside. Ookulli: the cap has to name the indemnity. Aber Law: carving indemnity out of the cap makes the ceiling decoration. Sprintlaw: naming loss of profits can override a consequential-loss exclusion. Walk the stack, then open the MSA liability cap review for the number.

• Do: log inside / outside / super-cap / silent.
• Do not: assume twelve months of fees covers the promise to pay.

Keep, narrow, or escalate: which position do you send?

Pick one position per trigger. Keep is a named third-party clause you can live with. Narrow is a four-to-six-line redline. Escalate is a named High flag — an item scored high severity — for counsel.

Keep named triggers you control, defend plus notice plus consent, and customer use limited to your content or your breach. Narrow related to into caused by; put your indemnity inside the cap; exclude their negligence. Escalate uncapped customer use plus defend plus their negligence, or silence on the stack. Geoffrey Leaver (20 August 2026): agree some financial cap unless the indemnity is tightly drafted.

• Do: send 4–6 redlines or one named High flag.
• Do not: dump the whole MSA on counsel.

Which wording should pause the deal?

Highlight one sentence. The pause is wording that puts you on the hook for their risk, on an allegation, with no ceiling. If you cannot point to that sentence, you have not finished the log.

Pause on: Customer shall defend, indemnify and hold harmless Vendor and its affiliates from any and all claims arising out of or related to this Agreement or Customer’s use of the Services — no carve-out for Vendor’s negligence, no cap cross-reference. Also pause if you indemnify their negligence or notice is missing. Harvey: covering the counterparty’s negligence prices risks you never bought.

Success bar: fill the one-page log (who → trigger → losses covered → defend vs indemnify → notice / control / settlement → inside / outside / super-cap → keep / narrow / escalate) and point to one sentence that would pause the deal. Workflow: packet → who pays whom → trigger → defend vs indemnify → cap stack → keep/narrow/escalate → pause-wording. Checkory can run a first-pass — the first machine pass that extracts clauses before a human reads every page.

• Do: highlight the High sentence and escalate it by name.
• Do not: sign past related-to use or their negligence.

If the same packet is a subscribe deal, also open the SaaS agreement red flags checklist.