Software and SaaS company insurance: coverage, requirements and costs

A software or SaaS company's core policy is technology errors and omissions (tech E&O), written together with cyber liability. Add directors and officers (D&O), employment practices liability (EPLI) and crime as you take on investors and employees. The business sits mainly in NAICS 513210 (software publishers), with custom development in 541511 and hosting and data processing in 518210. The trade's insurance problem is that your product is your exposure: a single bug, outage or breach reaches every customer at once, and your enterprise customers write the limits you must carry into their contracts.

Why software companies need business insurance

A defect is a mass claim. A physical product fails one unit at a time. Software ships the same fault to every customer on the same release. Travelers' page for technology companies lists software developers' exposure as errors, omissions, negligence and product failure. Customers claim for lost revenue, not for the subscription fee, and the contract's liability cap is the main thing between you and that exposure.

You hold the customer's data. A SaaS platform is a concentrated store of other companies' records, which is why breach claims arrive as a group and why customers send long security questionnaires before they sign. Insurers use similar controls to price cyber: see MFA, EDR and backups: the controls cyber insurers now require.

Standard policies do not fit. A general liability policy pays for bodily injury and property damage, and standard forms do not treat data or lost revenue as either. A BOP does not cover professional services unless endorsed. Software is not on the usual shelf; underwriters use technology-specific forms.

Investors and employees add management exposures. Once you take outside money, directors face claims from investors and the company needs D&O. Hiring remote staff across states multiplies employment and workers' comp obligations.

Core coverages

• Technology E&O. Covers third-party financial loss from failure of your software or services to perform. Read for exclusions of breach of contract, express warranties, guarantees of results, delay, and patent infringement, since SaaS agreements contain all of them. Chubb's DigiTech ERM page describes one form that combines tech E&O, media and cyber, with no exclusion for delays or failure to deliver and optional software copyright coverage. Forms differ; see Technology E&O insurance for software, SaaS and IT firms.
• Cyber liability. First-party breach response, business interruption, data recovery and ransomware extortion, plus third-party privacy and network security liability. Travelers and Chubb both publish technology cyber products with regulatory proceedings and payment card coverage. See cyber insurance: what it covers for a business and Cyber insurance vs tech E&O: which policy pays when to avoid gaps and overlaps; combined forms address the "each policy points at the other" problem.
• Media liability. Covers claims about content your product publishes or that users upload: copyright, defamation and privacy. See media liability insurance: defamation, copyright and content claims.
• Directors and officers and EPLI. D&O covers the board and company for claims by investors and regulators; EPLI covers employee claims. See employment practices liability.
• Crime. Employee theft, funds-transfer and social engineering fraud; vendor-payment redirection is the common claim for startups.
• General liability, property and workers' comp. Office visitors, laptops and servers, and employee injuries including remote staff. See commercial general liability.

Coverage you may be required to carry

No state requires E&O for a software company. Requirements come from contracts and investors. Enterprise customers' master agreements and security questionnaires commonly ask for tech E&O and cyber at $2 million to $10 million or more, CGL at $1 million per occurrence / $2 million aggregate, umbrella, crime, and workers' comp. Customers often ask to be named as additional insured on the GL and to receive notice of cancellation. Public-sector and healthcare customers add their own terms; if you process protected health information you are a business associate under HIPAA, which brings a breach-notification obligation and typically a cyber requirement from the covered entity. Investors usually require D&O in the term sheet or closing checklist. Workers' comp applies in each state where you have employees, including remote ones (see workers' comp requirements by state: who must carry it). Use contract insurance requirements checker and read how to review the insurance requirements in a contract.

Common claims and how to prevent them

• Defects and outages. Staged releases, feature flags and rollback plans, and published SLAs with credits as the sole remedy for downtime.
• Contract exposure. Limit liability to fees paid in the prior 12 months where customers accept it, exclude consequential damages, and avoid warranties of uninterrupted operation. Your insurer reads the terms of service as part of underwriting.
• Breach. Multi-factor authentication, encryption, logging, and incident response plan tested in a tabletop. Keep backups separate from production.
• Open source and IP. Maintain a bill of materials and review copyleft licenses before shipping. Use written assignment agreements for contractors.
• Generative AI. ISO's January 2026 generative AI exclusion endorsements (CG 40 47, CG 40 48 and CG 35 08) show carriers are addressing AI-related liability. If your product or your developers use AI, ask whether your tech E&O or media form excludes AI-generated output.
• Marketing statements. Claims on your website that a product is "secure" or "compliant" can become the basis of a misrepresentation claim.
• Employment. Written policies, offer letters and documented termination decisions.

What drives the cost

• Tech E&O and cyber: annual revenue is the usual exposure base. Underwriters weigh product type (back-office tools versus financial, healthcare or safety-critical software), customer concentration, size of largest customers, number of customers and records held, contract terms, and security controls.
• Claims-made structure: retroactive date and prior claims; the policy responds only to claims first made while it is in force, so keep continuous coverage or buy an extended reporting period. See prior acts coverage and retroactive dates.
• D&O: funding stage, investor mix, headcount and any litigation or regulatory history.
• General liability: revenue or square footage; workers' comp: payroll by class code, usually a low-rated clerical or computer-programmer class.
• Underwriting questions: SLAs, indemnity terms, backups, use of subcontractors and AI, and regulated-data exposure.

Specialized coverages to consider

• Umbrella where customers set limits above your primary.
• Contingent business interruption for dependence on a cloud host. See cyber business interruption and dependent system failure.
• Fiduciary liability once you offer a 401(k) plan.
• Tail coverage at acquisition or wind-down; see tail coverage and extended reporting periods.

How to buy

Early-stage companies can buy tech E&O and cyber online from technology carriers or through a broker that handles venture-backed accounts, which also places D&O at financing. Larger SaaS companies with enterprise customers should use a broker who can negotiate the combined form. Have ready: revenue and ARR, product description, top customers and their contract limits, standard terms of service and master agreements, a security summary (SOC 2 or equivalent if you have one), cap table highlights for D&O, and loss runs. Complete the cyber insurance readiness checklist first. See how to prepare an insurance submission underwriters will read.

Key takeaways

• Tech E&O combined with cyber is the core program; read exclusions for contract, delay and warranty claims.
• Your liability cap in customer contracts matters as much as your policy limit.
• Enterprise customers and investors set your limits; there is no state mandate.
• Keep continuous claims-made coverage so you do not lose past work.
• Ask whether any AI exclusion applies to your product or code.