Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement establishes that W&B's maximum financial liability for data privacy and security breaches, including violations of data protection laws, is capped at three times the total fees paid by Customer in the 12 months preceding the event, rather than being uncapped.
This analysis describes what Weights & Biases's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a specific financial ceiling on W&B's liability for data breaches and data protection law violations, which is a materially different risk allocation than an uncapped liability structure and may be relevant to procurement teams assessing vendor risk in regulated industries.
The updated agreement no longer includes language stating that a previously executed written agreement between Customer and W&B would govern and supersede the master service agreement. This removal eliminates explicit recognition of contractual hierarchy that may have applied to customers with signed agreements predating the master terms. The practical effect depends on whether such customers have separate agreements in place and how contract interpretation and applicable law would treat the relationship between a posted master agreement and a signed customer agreement absent explicit supersession language.
View change record →The updated Terms of Service no longer include the previous statement that services would become inaccessible from certain locations starting September 1st, 2025. This removal means the geographic restriction that was previously announced in the agreement is no longer formally stated in the current terms. Users who were affected by or concerned about the prior restriction should review current documentation to confirm whether any geographic limitations remain in effect.
View change record →Under this clause, W&B's total financial liability for any data breach, privacy violation, or data protection law violation is capped at three times the fees paid in the prior 12 months. Customers with large datasets of sensitive information should assess whether this cap is adequate relative to their potential exposure from a data security incident.
Cross-platform context
See how other platforms handle Privacy and Security Breach Liability Cap at 3x Fees and similar clauses.
Compare across platforms →Monitoring
Weights & Biases has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
""Excluded Claims" means any claim or liability arising out of or related to any breach by W&B of its confidentiality, privacy and security obligations or any violation of data protection laws, including any breach of Section 4 and Section 7. W&B's entire liability for all Excluded Claims will not exceed 3 times the total fees paid by Customer under this Agreement during the 12-month period prior to the event giving rise to the liability.Excerpt from Weights & Biases's Terms of Service
1) REGULATORY LANDSCAPE: This provision interacts with GDPR, which imposes fines on data controllers and processors independently of contractual liability caps, and does not eliminate regulatory penalties against the data controller (Customer). HIPAA likewise imposes regulatory obligations that exist independently of contractual liability limits. The DPA incorporated by reference should be reviewed to determine whether it imposes additional obligations on W&B beyond this contractual cap. 2) GOVERNANCE EXPOSURE: Medium. The 3x fee cap on privacy and security breach liability is a bounded financial ceiling that may be significantly less than the potential regulatory, reputational, or operational exposure from a data breach involving Customer Data. The carve-out of 'Uncapped Claims' for gross negligence, recklessness, and intentional misconduct provides a limited additional remedy. 3) JURISDICTION FLAGS: EU and EEA customers operating as data controllers bear primary GDPR compliance responsibility regardless of contractual liability caps. California customers should evaluate whether the cap interacts with CCPA private right of action provisions. Healthcare customers should assess HIPAA exposure, noting that the BAA applies only to Enterprise Order Forms. 4) CONTRACT AND VENDOR IMPLICATIONS: Procurement and risk teams in regulated industries should evaluate whether the 3x fee cap is adequate given the sensitivity of data processed through W&B, and whether cyber insurance or alternative contractual protections should be secured. The carve-out of 'Excluded Claims' from the general 12-month fee cap is a positive structural distinction relative to a flat cap. 5) COMPLIANCE CONSIDERATIONS: Legal teams should assess whether the 3x cap is consistent with the organization's vendor risk management requirements and whether additional contractual protections, security certifications, or audit rights should be negotiated. The DPA should be reviewed to assess whether W&B's security obligations and liability posture are adequate for the organization's data protection requirements.
This provision establishes a specific financial ceiling on W&B's liability for data breaches and data protection law violations, which is a materially different risk allocation than an uncapped liability structure and may be relevant to procurement teams assessing vendor risk in regulated industries.
Under this clause, W&B's total financial liability for any data breach, privacy violation, or data protection law violation is capped at three times the fees paid in the prior 12 months. Customers with large datasets of sensitive information should assess whether this cap is adequate relative to their potential exposure from a data security incident.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Weights & Biases.