diff --git a/proposals/2140-terms-of-service-2.md b/proposals/2140-terms-of-service-2.md
index 2e874ee8..f7b43376 100644
--- a/proposals/2140-terms-of-service-2.md
+++ b/proposals/2140-terms-of-service-2.md
@@ -96,7 +96,7 @@ to make calls to the IS on its behalf, it must also supply its access token for
 Identity Server alongside in the `is_token` key of the same JSON object. That is,
 in the main request object for a `requestToken` request and in the `threepidCreds`
 object when supplying 3PID credentials (eg. in the `m.email.identity` UI auth stage).
-Exxceptions to this are any requests where the only IS operation the Homeserver may
+Exceptions to this are any requests where the only IS operation the Homeserver may
 perform is unbinding, ie. `/_matrix/client/r0/account/deactivate` and
 `/_matrix/client/r0/account/3pid/delete`, in which case the unbind is authenticated
 by a signed request from the Homeserver.