Limitation of Liability

What it is

Duo limits the total amount it can be held responsible for to the fees you paid in the last twelve months, and excludes liability for lost profits, business interruption, or indirect damages even if Duo knew those losses were possible.

Why it matters (compliance & governance perspective)

For organizations relying on Duo for access control to critical systems, the financial recourse available if the service fails is capped at one year of subscription fees, which may be far less than the actual business impact of an authentication outage or security failure.

Consumer impact (what this means for users)

This clause means that if Duo's service fails and your organization suffers a significant security incident or operational disruption, the maximum financial compensation you could recover from Duo under these terms is limited to what you paid in the prior year, with no recovery for lost profits or business interruption losses.

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: Liability limitation clauses in technology service agreements are generally enforceable under U.S. contract law, though some jurisdictions restrict their application in cases of gross negligence or willful misconduct. For EU customers, consumer-facing limitation clauses may face scrutiny under Unfair Contract Terms Directive frameworks, though this is a B2B agreement and those protections are less directly applicable. The FTC Act is relevant if service availability representations differ materially from actual service performance. (2) GOVERNANCE EXPOSURE: High. The twelve-month fee cap creates material exposure for enterprises where annual Duo subscription costs are modest relative to the value of systems protected. A large organization paying $100,000 annually in Duo fees but protecting systems where an authentication failure could cause millions in losses has limited contractual recourse under these terms. (3) JURISDICTION FLAGS: EU/EEA customers should assess whether the limitation clause is consistent with applicable national contract law. California courts have at times limited enforcement of liability caps where the limitation is found to be unconscionable. Customers in regulated industries such as financial services and healthcare face heightened exposure if authentication failures result in regulatory fines or breach notification costs that exceed the liability cap. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should assess whether the liability cap is negotiable for enterprise or premier tier contracts. The mutual nature of the cap (applying to both parties) is standard but does not change the asymmetric risk profile where Duo's potential losses are bounded by its fee income while the customer's losses are not. Vendor risk assessments should document this cap and ensure it is reflected in organizational risk registers and cyber insurance coverage. (5) COMPLIANCE CONSIDERATIONS: Legal teams should confirm whether the organization's cyber insurance policy covers losses that exceed or fall outside the scope of Duo's contractual liability. Contract review triggers should include re-evaluation of this cap at each renewal, particularly as the scope of Duo-protected systems expands.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Disclaimer of Warranties medium
• Customer Responsibility for End-User Management medium
• Data Processing and Privacy Obligations medium
• Termination for Cause medium
• Intellectual Property and License Grant low
• Acceptable Use Restrictions low