Does our technology errors and omissions policy cover our contractual indemnity obligations?

Partly, and the terms matter. Liability policies generally exclude liability assumed under contract and then give back limited categories, such as liability you would have had without the contract or liability under a defined insured contract. Whether your form responds to the specific indemnity categories in your master services agreement is something to read in the exclusions and the definitions, not something to assume from the fact that you bought technology coverage.

Why does patent infringement matter here?

Because customers commonly ask for intellectual property indemnity without distinguishing between types, while many technology errors and omissions forms cover copyright, trademark, and trade secret but exclude patent infringement. That creates a promise with no insurance behind it. The options are to carve patent out of the contract indemnity, to seek a form or endorsement that addresses it where available, or to accept the exposure knowingly. All three are better than discovering it during a claim.

Our liability cap is twelve months of fees. Are we protected?

Only for the categories inside the cap. Most SaaS agreements carve out confidentiality and data breach, intellectual property indemnity, and sometimes gross negligence, and those carve outs sit outside the cap and are frequently uncapped. So the cap limits your performance failure exposure while leaving the security exposure open. The practical takeaway is to size the cyber limit to the carve out exposure at your largest accounts rather than to the cap.

A customer wants us to name them as additional insured on our professional liability policy. Can we?

Usually not. Additional insured status is a general liability concept, and most professional liability and technology errors and omissions carriers do not add additional insureds, because the coverage responds to the insured's own professional errors. This is a standard negotiation point, and customers generally accept alternatives such as evidence of coverage at a stated limit, a waiver of subrogation where available, or notice of cancellation. Raise it before signature rather than promising it and failing to deliver.

What should we do before signing an enterprise insurance exhibit?

Compare it against your actual certificate of insurance, line by line, and flag anything you do not currently carry: limit levels, separate cyber limits, additional insured or primary and non contributory language, waiver of subrogation, and any requirement to maintain coverage for years after termination, which on a claims made policy means purchasing a tail. Each item is negotiable or solvable before signature and becomes a breach after it.

When Your SaaS Contract Promises More Than Your Policy Pays

The Indemnity Clause Versus the Insuring Agreement

Enterprise customers typically ask for indemnity across several categories: intellectual property infringement, breach of confidentiality or data protection obligations, breach of representations and warranties, violation of law, and sometimes gross negligence or willful misconduct. Each of those is a promise to defend and pay on the customer's behalf. Your technology errors and omissions policy covers claims arising from your professional services or your product failing to perform. Your cyber policy covers privacy and network security events. Between them they cover a good deal of what a typical indemnity promises, but not all of it, and the misalignment is predictable. Contractual liability is the first issue. Liability policies generally exclude liability assumed by contract, then give it back for an insured contract or where the liability would have existed anyway. Whether your technology errors and omissions form covers contractual indemnity obligations, and on what terms, is a specific thing to read. Second, intellectual property indemnity is often narrower in the policy than in the contract: many technology forms cover copyright, trademark, and trade secret but exclude patent infringement, which customers routinely ask you to indemnify. Third, obligations around regulatory fines and penalties, which some contracts push onto the vendor, are often insurable only where the law allows, and sometimes not at all.

Policies generally exclude contractual liability, then give back limited categories
Many technology errors and omissions forms exclude patent infringement while contracts require indemnity for it
Regulatory fines and penalties are insurable only where law permits, and not under every form
Compare the indemnity categories in your template against the insuring agreements line by line

Liability Caps, Carve Outs, and the Real Exposure

Most SaaS agreements cap total liability, commonly at some multiple of fees paid, and then carve out categories that sit outside the cap. Those carve outs are where the unlimited exposure lives, and they are usually confidentiality and data breach, intellectual property indemnity, and sometimes gross negligence. That structure means the number that matters is not the cap. It is the carve out. A company with a twelve month fee cap and an uncapped data breach carve out has a limited exposure on performance failures and an unlimited one on a security incident. The insurance program should be sized to the carve outs, not to the cap. Two practical consequences. First, if the customer will not accept a cap on the data breach carve out, that is a strong argument for a cyber limit sized to the realistic cost of a breach affecting your largest customers, not to the average cost across your book. Second, the carve out language should be read for whether it includes consequential and indirect damages, because a carve out that preserves a consequential damages waiver behaves very differently from one that does not.

Liability caps matter less than the carve outs that sit outside them
Confidentiality, data breach, and intellectual property indemnity are the usual uncapped categories
Size the cyber limit to the carve out exposure at your largest customers
Check whether carve outs preserve or remove the consequential damages waiver

Insurance Requirements You Agreed To and May Not Meet

Enterprise procurement sends an insurance exhibit, and someone in sales signs it. Those exhibits routinely require coverages and limits that the company does not have, in forms it does not carry, with endorsements that are not always available in the market. The requests that most often cause problems are a technology errors and omissions limit above what the company currently buys, a separate cyber limit when the company has a combined form, an additional insured requirement on a professional liability policy, which many carriers will not provide because professional liability does not customarily add additional insureds, a waiver of subrogation, a primary and non contributory endorsement, and a requirement that coverage be maintained for a stated number of years after termination, which on a claims made form means buying a tail. Every one of those is negotiable or solvable, but only before signature. After signature it is a representation the company is in breach of, which can surface during a dispute as a separate contractual failure alongside whatever actually went wrong. The fix is a short internal process: insurance exhibits get reviewed against the actual certificate before the contract is signed, not after.

Insurance exhibits frequently require coverage the company does not carry
Additional insured status on professional liability is often unavailable, so negotiate the term
Post termination coverage requirements on a claims made form mean buying a tail
Review the insurance exhibit against the real certificate before signature, every time

Aligning the Program With the Contract Template

The efficient way to solve this is from the template side rather than the deal side. Standardize what your master services agreement promises, then build the insurance program to match it, then handle customer redlines as exceptions you price and track. The sequence looks like this. Inventory the indemnity categories and carve outs in your standard template. Pull the insuring agreements and exclusions from your technology errors and omissions and cyber policies and map each contract category to a policy response or to no response. Where there is no response, decide whether to change the template, buy different coverage, or accept the exposure deliberately. Then set an internal rule about which redlines require broker review before acceptance, so the sales team knows when to escalate. Keep a record of the exceptions you accepted and for which customers, because it is the only way to understand your aggregate exposure. A single uncapped data breach carve out is a manageable risk decision. Forty of them, spread across contracts nobody tracked, is an aggregation problem your cyber limit was never sized for.

Build the program to match the standard template, then treat redlines as priced exceptions
Map every contract indemnity category to a policy response or to none
Set a rule for which redlines require broker review before acceptance
Track accepted exceptions by customer, since aggregated carve outs become a limit problem

Frequently Asked Questions

Related Resources

This article is for general information and is not a substitute for policy language or professional advice.

Back to All Insights