A limitation-of-liability clause sets a ceiling on how much you can recover from your MSP if something goes wrong — a breach, an outage, a security incident, a mistake that costs your business money. It is standard in commercial IT contracts and not inherently unfair. What matters is exactly what the cap covers, how it is measured, and what falls outside it — three things that vary a lot between published contracts.
How the cap is usually measured
The most common structure ties the cap to fees already paid — commonly expressed as a number of months of fees under the agreement. A floor of six months of fees shows up as a practitioner-recommended benchmark in at least one published template; twelve months appears in other published agreements. A lower cap, measured in months of fees, means a smaller ceiling on recovery relative to how long you have been a customer — which matters more the newer the relationship, since fewer months of fees have been paid.
A different, less common structure ties the cap to whatever the provider's insurance actually pays out, with no separate minimum stated in the contract. That is a materially different promise: your recovery depends on an insurance policy you have not seen, rather than a number you can calculate from your own invoices.
Does the cap apply to everything, or does a security incident carry a separate number?
This is the single most consequential detail in the whole clause. Some published agreements apply one cap to every kind of claim, including a data breach or security failure — meaning a serious privacy incident is capped at the same low ceiling as a routine billing dispute. Others carve out a separate, higher tier specifically for breaches of data-security or privacy obligations. Search your contract for whether "data," "privacy," "security incident," or "breach" appears anywhere near the limitation-of-liability section with a different number attached — if it does not, the general cap is very likely what governs a security incident too.
What's usually excluded from the cap
A cap that excludes nothing is unusual; the real question is which exclusions your contract lists. Three exclusions are commonly treated as reasonable, provider-side baseline carve-outs: third-party intellectual property infringement, gross negligence, and willful misconduct. A cap with meaningfully more exclusions than that baseline is worth reading closely — every additional exclusion is a category of claim where the ceiling does not apply, which can matter more than the headline cap number itself.
The notice-of-claim deadline hiding in the same section
Limitation-of-liability clauses are frequently paired with a short, fixed deadline to notify the provider of a claim — a published example requires notice "within ninety (90) days after the event or discovery of the event." Miss that window and the substantive cap may never matter, because the claim itself is time-barred under the contract. Check for this deadline separately from the cap amount; it is easy to read past.
Damages waived in one direction only
Look for a waiver of consequential, indirect, and lost-profit damages. This is common and often reasonable — but check whether it runs only against the provider, with no matching waiver protecting the provider from the same categories of claim from you. A one-directional waiver is a meaningfully different bargain than a mutual one, even though both read as boilerplate at first glance.
How a cap interacts with an indemnity clause
A separate indemnity clause — an obligation to cover the other party's losses from a defined category of claim, such as third-party IP infringement or a data breach you caused — can sit either inside or outside the liability cap. If an indemnity obligation is drafted outside the cap, the cap's headline number does not actually limit your exposure for whatever the indemnity covers. Read the two clauses together, not in isolation: a contract that advertises a modest liability cap while carving indemnity obligations out of it entirely can leave you with materially more exposure than the cap number alone suggests.
Why the cap amount alone is not the whole picture
Two contracts can state the same headline cap — say, six months of fees — and still leave you in very different positions depending on three things covered above: whether a security incident shares that general cap or has its own higher tier, how many exclusions sit outside the cap altogether, and how strict the claim-notice deadline is. A business owner comparing providers by cap amount alone, without checking these three details, is comparing an incomplete picture. This is also why a single number quoted verbally by a sales representative is not a substitute for reading the actual clause — the number can be accurate and still tell you very little without the surrounding text.
What this does not tell you
None of this is a prediction of what a specific cap would mean in a real dispute, or whether a court in your state would enforce it as written — that depends on facts, jurisdiction, and arguments a document-reading tool cannot evaluate. Limitation-of-liability clauses are also subject to state-by-state rules about what a court will and will not enforce, and those rules are not covered here because they require a jurisdiction-specific legal analysis this page is not qualified to give. If a liability cap matters to a decision you are actually making (signing, renewing, or responding to an incident), the number and its exclusions are worth a licensed attorney's specific read of your contract and your situation.
See your own cap, quoted verbatim
TermSentinel extracts the liability cap, its measurement basis, its exclusions, and the claim-notice deadline from an uploaded agreement, with the source text quoted next to each finding.