Business Insurance

Business Insurance for SaaS

Overview

Insurance is boring until you need it — then it saves your company. Enterprise customers demand proof of insurance. Investors require D&O coverage. A data breach without cyber insurance can bankrupt a startup. The mistake: waiting until a contract requires insurance to start shopping. Policies take 2-4 weeks to bind. Losing a $100K deal because you don't have insurance is an unforced error. This skill covers every insurance type a SaaS founder needs, when it becomes necessary, and how to get it.

Authoritative Foundations

• Vouch — Startup insurance specialists — Startup insurance specialists
• Embroker — Tech/SaaS insurance — Tech/SaaS insurance
• Coalition — Cyber insurance — Cyber insurance
• Founders Shield — Startup risk management — Startup risk management
• At-Bay — Cyber and E&O insurance — Cyber and E&O insurance

When to Use

Trigger phrases: "business insurance", "startup insurance", "E&O insurance", "cyber liability", "D&O insurance", "what insurance do I need", "enterprise customer requiring insurance", "insurance for SaaS", "technology E&O"

Insurance Timeline by Stage

Insurance Types Deep Dive

1. Technology Errors & Omissions (Tech E&O)

What it covers: Claims that your software caused financial loss to a customer due to errors, bugs, downtime, or failure to perform as promised. Also covers intellectual property infringement (not patent).

Typical coverage: $1M per occurrence / $2M aggregate (minimum for enterprise). Some enterprises require $5M.

Real scenarios it covers:

• Your API goes down for 4 hours. Customer loses $50K in revenue. They sue.
• A bug in your billing system overcharges 200 customers. They demand refunds + damages.
• Your software doesn't deliver the results you promised in the sales process.

What it DOESN'T cover:

• Intentional wrongdoing or fraud
• Bodily injury or property damage (that's General Liability)
• Data breaches (that's Cyber)
• Employment claims (that's EPLI)

Cost: $1,500-5,000/yr depending on revenue, coverage limits, and risk profile.

Trigger event: First enterprise or mid-market customer. Their procurement team will ask for a Certificate of Insurance (COI) listing them as additional insured. Without it, deal blocked.

2. Cyber Liability Insurance

What it covers: Costs related to data breaches, hacking, ransomware, and privacy violations. Covers: forensic investigation, legal fees, notification costs, credit monitoring for affected customers, PR/crisis management, and regulatory fines (where insurable).

Typical coverage: $1M (minimum). $2-5M if you handle sensitive data.

Real scenarios it covers:

• Customer database breached. 5,000 records exposed. Notifications required. Forensic investigation identifies the vulnerability. Legal counsel manages regulatory reporting. Total cost: $200-500K. Cyber insurance covers it.
• Ransomware attack encrypts your production servers. $50K ransom demand. Insurance covers negotiation, ransom payment, and recovery costs.
• Customer sues you for failing to protect their data under your DPA.

What it DOESN'T cover:

• Pre-existing breaches (before policy effective date)
• Intentional acts by the insured
• War or state-sponsored attacks (some policies exclude this)
• Regulatory fines in all jurisdictions (check policy)

Cost: $1,500-5,000/yr. Premium heavily influenced by your security posture: SOC2, penetration testing, MFA, encryption — all reduce premiums.

Trigger event: You store ANY customer data. Even if you don't have enterprise customers yet. One breach can kill an uninsured early-stage startup.

3. Directors & Officers (D&O) Insurance

What it covers: Claims against directors and officers for wrongful acts in managing the company. Covers: breach of fiduciary duty, mismanagement, employment-related claims from shareholders, securities claims.

Typical coverage: $1-5M depending on stage and funding.

Real scenarios it covers:

• Investor sues board for mismanagement after down round.
• Employee/shareholder claims dilution was handled improperly.
• Competitor claims your board member used confidential information.
• IPO/SPAC-related securities claims (later stage).

When you need it:

• Before your first VC round (investors will require it)
• When you have a board of directors
• When you have outside investors

Cost: $2,000-10,000/yr. Startups on the low end. Public companies: $100K+.

4. General Liability (GL)

What it covers: Bodily injury, property damage, personal injury (libel, slander), advertising injury. NOT professional errors (that's E&O).

Typical coverage: $1M/$2M. Often combined with E&O in a package.

Real scenarios: Someone slips at your office. You damage a client's property during an on-site visit. A competitor sues you for false advertising.

Cost: $300-800/yr. Cheapest coverage. Required for office leases and events.

5. Workers Compensation

What it covers: Employee injuries or illnesses arising from employment. Required by law in almost every state as soon as you have W-2 employees.

Cost: $500-2,000/yr for office-based companies. Higher for physical work.

Trigger: First W-2 employee. No exceptions. It's the law.

6. Employment Practices Liability (EPLI)

What it covers: Claims of wrongful termination, discrimination, harassment, retaliation, and other employment-related wrongs.

When you need it: 5+ employees. The risk of employment claims increases with headcount.

Cost: $1,000-3,000/yr.

7. Key Person Insurance

What it covers: Life insurance or disability insurance on key founders. If a founder dies or becomes disabled, the company receives a payout to cover transition costs, recruiting, and lost momentum.

When you need it: Company depends on 1-2 people for survival. Investors may require it on the CEO/CTO.

Cost: $1,000-3,000/yr depending on age, health, and coverage amount.

How to Shop for Insurance

Step 1: Work with a broker that specializes in startups. Don't go to Geico or State Farm — they don't understand SaaS.

Recommended brokers:

• Vouch (vouch.us) — built for startups, fast quotes, digital-first
• Embroker (embroker.com) — tech/SaaS focused
• Founder Shield (foundershield.com) — risk management for startups
• Coalition (coalitioninc.com) — cyber + E&O specialist

Step 2: Get quotes from 2-3 brokers. Premiums vary significantly.

Step 3: Provide accurate information. Undisclosed risks = denied claims.

Step 4: Review policy exclusions. Know what's NOT covered.

Step 5: Pay annually. It's cheaper than monthly and you won't forget.

Output Format

BUSINESS INSURANCE — [Company]

Current Stage: [$X ARR, X employees, X enterprise customers]

POLICIES NEEDED:
| Policy | When | Coverage | Est. Cost |
|---|---|---|---|
| Tech E&O | [trigger event] | $XM | $X |
| Cyber | [trigger event] | $XM | $X |
| D&O | [trigger event] | $XM | $X |
| GL | [trigger event] | $XM | $X |
| Workers Comp | [trigger event] | $XM | $X |

BROKERS:
- [Name]: [quote / contact info]

ENTERPRISE REQUIREMENTS:
- [Customer 1]: requires $2M E&O + $2M Cyber + COI naming them as additional insured
- [Customer 2]: requires $1M E&O

Implementation Checklist

• Tech E&O in place before first enterprise deal
• Cyber liability in place if you store any customer data
• D&O in place before fundraising (investors will require it)
• Workers Comp in place before first W-2 employee (it's the law)
• COI template ready (enterprise customers will ask)
• Annual review of coverage limits (they should grow with revenue)
• Broker is startup-specialized (not a generalist)
• Policy exclusions reviewed and understood

Quality Check

Before delivering, verify:

• Output matches the user's stated request
• Named frameworks or sources are reflected in the recommendation
• The deliverable is specific enough for an agent to execute
• Any assumptions, risks, or dependencies are explicit
• No unsupported claims, invented facts, or private/internal references are included

Common Pitfalls

1. No E&O before enterprise deal. Enterprise procurement asks for COI. You don't have it. Deal blocked for 2-4 weeks while you shop for insurance. Some customers walk away. Fix: Get E&O when you start targeting mid-market or enterprise — before the first deal, not during it.

2. Thinking "we're too small to get sued." You're not. A $100K ARR startup can be sued for $1M by a customer who lost money during your downtime. Fix: Insurance is cheaper than being right in court.

3. Buying the cheapest policy. Lowest premium = most exclusions = claims denied when you actually need it. Fix: Compare coverage, not just price. Understand what's excluded.

4. Not naming enterprise customers as additional insured. Enterprise contract says "name us as additional insured on your E&O." You buy E&O but forget to add them. They reject the COI. Fix: Your broker handles additional insured endorsements. Ask for one per enterprise customer.

5. Lying on the application. "We've never had a security incident." But you had a breach last year. The insurer finds out. Claim denied. Policy rescinded. Fix: Be honest on insurance applications. They can and will investigate before paying large claims.

⚠️ Disclaimer

This skill provides general informational guidance based on publicly available frameworks and operator experience. It is NOT legal advice, accounting advice, tax advice, financial advice, insurance advice, or professional services advice.

Consult qualified professionals for your specific situation — attorneys for legal/equity matters, CPAs for tax and accounting, licensed brokers for insurance, and certified security assessors for compliance. This skill does not create a professional-client relationship. Use it as a starting point for research and preparation.

Execution Artifacts

• references/framework-notes.md — Named frameworks and reference tables
• templates/output-template.md — Deliverable shell for agent output
• scripts/check-output.py — Lightweight deliverable validator

Related Skills

• legal-for-founders — Incorporation, IP, contracts, ToS
• soc2-compliance — Security posture that reduces insurance premiums
• data-privacy-compliance — Compliance that cyber insurance expects
• security-assessments — Pen tests and audits that insurers may require
• fundraising-strategy — D&O insurance timing for VC rounds