with the skill
# Contract Review: Veridian Helpdesk Subscription Agreement (§§ 9-11)
**Parties:** Veridian Cloud, Inc. (Provider) / Larkspur Retail Group (Customer, your side)
**Value:** ~$48,000/year
**Review basis:** Generic commercial standards. No playbook was provided, so these are not Larkspur's own positions.
**Scope:** Only the three excerpts you pasted. I haven't seen the data protection, security, confidentiality, or termination terms, which interact with these sections.
## Key Findings
| # | Clause | Rating | Issue |
|---|--------|--------|-------|
| 1 | §10 Indemnification | **RED** | One-way, uncapped, and covers "any breach" and anything "relating to" your use of the service |
| 2 | §9 Customer liability | **RED** | Your liability is expressly unlimited, while the Provider's is capped |
| 3 | §9 Provider cap | **RED** | About $12,000 at best, possibly $0, with no carve-outs |
| 4 | §11 + §10 combined | **RED** | No IP indemnity or warranty from the Provider, and §10 could make *you* cover claims about *their* product |
| 5 | §9 Consequential damages | **YELLOW** | The exclusion protects only the Provider |
## Clause-by-Clause Analysis
### §9 Limitation of Liability: RED
Show the rest (99 more lines)
**Contract says:**
- Provider's liability is capped at fees paid in the 3 months before the claim.
- Provider is not liable for indirect, consequential, or lost-profit damages.
- Customer's liability is unlimited.
**Problems:**
- **The cap is very low.** Three months of fees is about $12,000. The wording is also ambiguous. If you pay annually in advance and the claim arises 4+ months after payment, "fees paid in the preceding three months" could be **$0**. The usual market position is 12 months of fees, often with higher caps for data and confidentiality.
- **It's one-sided.** Only the Provider's liability is capped. Your exposure is unlimited, including for ordinary breaches.
- **There are no carve-outs.** Gross negligence, willful misconduct, fraud, confidentiality breaches, and data breaches are all capped at the same small amount. For a ticketing tool holding your customers' personal data (names, emails, order details, possibly payment-related info), a breach could cost far more than $12,000 in notification, forensics, regulatory, and claim costs.
- **The consequential damages exclusion is one-way.** It protects only the Provider. Breach response costs and lost data may also be characterized as "consequential," so the exclusion could swallow your real losses.
- **The scope is narrow.** "Arising out of this Agreement" may not clearly cover tort claims, and the clause has no per-claim versus aggregate language.
**Business impact:** In a serious incident you could recover roughly $0-$12,000 while remaining exposed without limit to the Provider.
**Redline:**
> **Current:** "Provider's total liability arising out of this Agreement shall not exceed the fees paid by Customer in the three (3) months preceding the claim. In no event shall Provider be liable for any indirect, consequential or lost-profit damages. Customer's liability under this Agreement is not limited."
>
> **Proposed:** "9.1 Except as set out in Section 9.3, each party's total aggregate liability arising out of or relating to this Agreement shall not exceed the fees paid and payable by Customer in the twelve (12) months preceding the first event giving rise to liability.
> 9.2 Except as set out in Section 9.3, neither party shall be liable for any indirect, consequential, special, or punitive damages, or lost profits, arising out of or relating to this Agreement.
> 9.3 The limitations in Sections 9.1 and 9.2 do not apply to: (a) a party's fraud, gross negligence, or willful misconduct; (b) a party's indemnification obligations under Section 10; (c) Customer's obligation to pay undisputed fees; or (d) liability that cannot be limited by law. Provider's liability for breach of its confidentiality, data protection, or security obligations shall not exceed the greater of [three (3) times annual fees / $[X]] (the 'Data Cap'), which shall apply in place of Section 9.1."
**Rationale (shareable):** Mutual caps and exclusions are standard. The proposed cap reflects the actual risk Provider takes on when hosting Customer's support data.
**Priority:** Must-have (mutuality and cap floor). Should-have (data super-cap).
**Fallback:**
- Keep 12 months of fees as the general cap.
- Accept a data super-cap of 2x annual fees, or the Provider's cyber insurance limits.
- As a last resort, accept a mutual cap with no super-cap, provided data breach costs are expressly treated as direct damages.
### §10 Indemnification: RED
**Contract says:** You must defend and indemnify the Provider against "any and all claims, losses and expenses arising out of or relating to Customer's use of the Services or any breach of this Agreement."
**Problems:**
- **It's unilateral.** The Provider gives you no indemnity of any kind.
- **It's extremely broad.** "Relating to Customer's use of the Services" covers essentially anything. It is not limited to third-party claims and doesn't exclude the Provider's own fault. You could owe indemnity for losses caused by the Provider's negligence or a Provider security failure.
- **"Any breach" converts every minor breach into an uncapped indemnity.** Combined with §9, your exposure is unlimited and the Provider's is trivial.
- **Procedure is missing.** There is no notice requirement, no right to control the defense, no settlement consent, and no duty to mitigate.
**Business impact:** If a third party sues the Provider over something involving your use of the service, including an IP claim about the platform itself, you could be on the hook for the full cost with no ceiling.
**Redline:**
> **Proposed:** "10.1 Customer shall defend Provider against any third-party claim to the extent arising from (a) Customer Data infringing or violating third-party rights or applicable law, or (b) Customer's use of the Services in violation of this Agreement or applicable law, and shall pay damages and costs finally awarded or agreed in settlement.
> 10.2 Provider shall defend Customer against any third-party claim to the extent arising from (a) an allegation that the Services infringe or misappropriate any third-party intellectual property right; (b) Provider's breach of its data protection, security, or confidentiality obligations; or (c) Provider's gross negligence or willful misconduct, and shall pay damages, costs, and regulatory fines finally awarded or agreed in settlement.
> 10.3 If the Services are, or in Provider's opinion are likely to be, subject to an infringement claim, Provider shall at its expense procure the right to continue use, modify the Services to be non-infringing, or, if neither is commercially feasible, terminate and refund prepaid fees for the unused term.
> 10.4 The indemnified party shall give prompt written notice, allow the indemnifying party to control the defense and settlement (provided no settlement may impose liability or admissions on the indemnified party without its consent), and reasonably cooperate at the indemnifying party's expense."
**Rationale (shareable):** Indemnities should track the risks each party actually controls. Customer covers its content and misuse, and Provider covers its platform and its handling of data.
**Priority:** Must-have (narrow Customer indemnity to third-party claims within its control, and add Provider IP indemnity). Should-have (data breach indemnity).
**Fallback:**
- Drop the data breach indemnity if the data super-cap and direct-damages treatment in §9 are accepted.
- Accept the Provider's standard IP indemnity form, if it includes defense and settlement costs and the refund remedy.
### §11 No Non-Infringement Warranty: RED (read with §10)
**Contract says:** The Provider gives no warranty that the Services don't infringe third-party rights.
**Problems:**
- On its own this is common in vendor paper, but it is normally balanced by an **IP infringement indemnity**. Here there is none.
- Combined with §10, if a third party sues the Provider over the platform, the Provider could argue the claim "relates to Customer's use" and pass it to you. If the claim is against you, you have no recourse.
- Infringement claims over the software itself are the risk you are least able to assess or control.
**Redline:**
> **Proposed:** Delete §11, or replace with: "Provider warrants that the Services, as provided by Provider, do not and will not infringe or misappropriate any third-party intellectual property rights. Provider's obligations in respect of any breach of this warranty are set out in Section 10.2."
**Priority:** Must-have, as part of the IP indemnity package.
**Fallback:** Keep the disclaimer if §10.2(a) (IP indemnity) and §10.3 (remedies) are accepted. That is the market compromise.
## Negotiation Strategy
**Tier 1, must-haves (escalate if refused):**
1. Remove the uncapped Customer liability by making the cap mutual, with a fixed 12-month baseline.
2. Narrow the Customer indemnity to third-party claims within your control, and delete "any breach" and "relating to use."
3. Add a Provider IP infringement indemnity.
**Tier 2, should-haves:**
- A data/confidentiality super-cap, and carve-outs for gross negligence, willful misconduct, and fraud.
- A mutual consequential damages exclusion that treats breach response costs as direct damages.
- A Provider data breach indemnity.
**Tier 3, concession candidates:**
- 12 versus 24 months of fees as the general cap.
- The size of the super-cap.
- Per-claim versus aggregate cap.
- Detailed defense procedure wording.
**Approach:** Lead with mutuality and the IP indemnity, since vendors rarely resist them. Trade on the super-cap size and cap multiple. At $48K/year, expect the Provider to resist a high super-cap but accept 12 months of fees with standard carve-outs. If they won't move on uncapped Customer liability or the one-way indemnity, treat that as an escalation point for senior counsel or business sign-off.
## Next Steps
1. **Confirm facts that affect the redlines:**
- Does the ticketing tool hold personal data (customer PII, payment-adjacent info)? If so, the data protection clauses and any DPA are critical and should be reviewed alongside §9.
- Is billing annual or monthly? This changes how badly the 3-month cap fails.
- What is your deadline and walk-away position?
- Does Larkspur have a playbook or standard positions I should apply?
2. Send the §§ 9-11 redlines above to Veridian.
3. Ask Veridian for its cyber/E&O insurance limits, which help justify the super-cap.
4. Send me the rest of the agreement (data protection, security, term and termination, confidentiality) for a full review, since those sections determine how much §9 matters.
*This analysis is for workflow support and is not legal advice. Have qualified counsel review before you rely on it or send redlines to the counterparty.*