Who We Insure · SaaS companies

SaaS insurance: coverage for SaaS and software companies

SaaS insurance is the coverage stack a software company carries because its customers wire its product into their own operations and sign contracts that require it: Tech E&O and cyber on one combined form, D&O once investors arrive, EPLI once you hire, and general liability for leases. Enterprise contracts commonly set a $1 million per-claim floor, scaling toward $2 million to $5 million for meaningful deals.

Reza Azar · Senior Insurance Broker · OnePark Risk

Last updated October 19, 2026

Request a Coverage Review · Speak With an Advisor

The short answer (as of October 2026)

Tech E&O and cyber on one combined form: the anchor policy for every SaaS company. Tech E&O responds when your product fails and a customer claims a financial loss; the cyber side funds breach response and the privacy claims that follow.
D&O at the priced round and EPLI at the first hires: most institutional term sheets require D&O at closing, and employment claims start the moment you have employees. Both usually sit on one management liability policy.
General liability or a BOP for leases, events and vendor checklists: inexpensive, and a certificate is almost always a precondition of a lease or vendor onboarding. Workers' compensation applies wherever you employ anyone.
Contract limits: a $1 million per-claim floor is common, scaling toward $2 million to $5 million for meaningful enterprise deals. Buy the limit the MSA names before signature, with the customer added as additional insured where the form allows.

Why SaaS companies carry specialized insurance

A SaaS company sells a promise of availability. Customers wire your product into their workflows, their revenue and their own obligations, then assume it will be there every morning. One shared codebase can propagate the same failure across every customer at once, so SaaS risk scales with adoption, and insurance requirements arrive the moment you sell upmarket.

Enterprise procurement teams send security questionnaires and insurance exhibits in the same package, and the exhibit names the policies, limits and certificate wording your program has to satisfy before signature. Generic business insurance templates were written for companies that sell labor or physical goods, not for a multi-tenant platform whose outage is both a service failure to its customers and a security event of its own.

OnePark Risk builds a SaaS program around what the product actually touches: the data you hold, how central you are to a customer's operations and what your contracts have promised.

The risk profile of a SaaS company

SaaS exposure concentrates where your code meets a customer's business. The failure is usually mundane — an outage, a regression, a misconfiguration — but the downstream loss and the contract you signed determine how large the claim becomes. Key exposures:

Service failures and outages that breach uptime commitments and disrupt customers' own operations
Software errors and faulty releases that corrupt, lose or wrongly process customer data
Data-breach exposure across a multi-tenant environment, where one incident can touch every customer at once
Contractual liability from MSA indemnities, warranties and service-level agreements
Third-party and open-source dependencies that fail inside your stack but leave customers looking to you
Intellectual-property and misrepresentation claims over features, integrations or marketing promises
Employment and management exposure that grows with headcount and each funding round

How underwriters look at a SaaS company

Underwriters price a SaaS company on a short list of facts; have them ready:

Revenue and ARR mix: total revenue, how much of it is recurring, and the split between enterprise, mid-market and self-serve customers.
Data types and record counts: whether you process payment data, health information or other regulated data, and roughly how many records sit in production.
Uptime and SLA commitments: the service levels your contracts promise, the credits attached to them and your actual availability history.
SOC 2 status: a current report, an audit in progress or neither.
Customer concentration and contract value: how much revenue your largest customers represent and the limits their agreements require.
AI features: where models touch customer-facing output, what human review exists and how that output is monitored.

Security controls get their own questions, starting with multi-factor authentication, endpoint detection, tested backups and a written incident-response plan.

The SaaS insurance stack

A SaaS company's program is six policies bought in sequence: Tech E&O and cyber together on one combined form, D&O when institutional investors or outside directors arrive, EPLI when you hire, general liability or a BOP for leases and vendor checklists, crime coverage as finance operations grow, and workers' compensation wherever you employ anyone.

Technology E&O + Cyber (combined form)

The anchor for any SaaS business. Technology E&O responds when your product fails and a customer claims financial harm; the cyber side funds breach response and the liability that follows a data incident. One combined form is the right structure because a single outage or breach is usually both at once.

Covers: customer claims for financial loss from software defects, errors or downtime; breach response, including forensics, notification and credit monitoring; network-security and privacy liability; ransomware recovery and the business interruption that follows.
Key exclusion: contractual guarantees beyond what the law would impose, such as uncapped indemnities or promised service credits, unless the form carves them back. Bodily injury and property damage belong to general liability.
When you need it: before the first customer contract that names it, usually the first contract of any size. See our guides to Tech E&O insurance for SaaS and software companies, Tech E&O for SaaS companies and cyber insurance for SaaS companies.

Directors & Officers (D&O)

D&O protects the personal assets of founders and directors against claims from investors, competitors, employees and creditors: misrepresentation in a raise, breach of duty in a board decision or disputes over an acquisition.

Covers: defense costs and settlements for claims against directors and officers personally, the company's indemnification of them, and on most private-company forms the entity itself.
Key exclusion: fraud and deliberate wrongdoing once established, and on many forms claims by one insured against another, with carve-backs for derivative and whistleblower claims.
When you need it: at the priced round at the latest, and earlier once you seat an outside director. Our D&O guide for SaaS companies and D&O insurance for startups cover timing and limits.

Employment Practices Liability (EPLI)

Fast hiring and rapid restructuring generate discrimination, harassment and wrongful-termination claims that cost money to defend even when they are meritless. EPLI funds that defense and any settlement, usually bundled with D&O in a management liability program.

Covers: defense and settlement of claims by employees, former employees and applicants, and on many forms third-party claims such as a harassment allegation from a customer.
Key exclusion: wages and benefits owed, most wage-and-hour claims beyond a defense sublimit, and intentional criminal acts.
When you need it: at the first hires, and certainly before the first layoff. See EPLI for startups.

General Liability & Property (BOP)

The routine layer that landlords and procurement checklists require: premises liability for visitors and coverage for the company's own equipment, inexpensive relative to the contracting friction it removes.

Covers: bodily injury and property damage to third parties, personal and advertising injury, and the office contents the property section schedules.
Key exclusion: professional services and the failure of your software, which is Tech E&O's job, and data breaches, which belong to cyber.
When you need it: when you sign a lease, host an event or face a vendor checklist that asks for a certificate. A BOP packages the two for smaller companies.

Crime / Employee Dishonesty

As finance and vendor operations grow, social engineering and funds-transfer fraud — a spoofed invoice, a redirected payroll run — become balance-sheet events.

Covers: employee theft of money, securities and property; forgery; computer fraud; and, by endorsement, social engineering and funds-transfer fraud.
Key exclusion: social engineering unless endorsed, and the endorsed sublimit is often well below the policy limit.
When you need it: once the company moves money on a schedule, and certainly once an enterprise customer asks for it.

Workers' Compensation

Required in nearly every state where you employ anyone, including a single remote hire. Distributed teams should confirm the policy tracks each state where an employee actually sits, because coverage follows the work, not headquarters.

Covers: medical costs and lost wages for work-related injury and illness, and the employer's liability for related suits.
Key exclusion: independent contractors in most states, and employees in states the policy does not list.
When you need it: before the first employee's first day, in that employee's state.

What SaaS insurance typically doesn't cover

No single policy in the stack covers a SaaS company end to end. Tech E&O does not pay your own breach costs, cyber does not pay a customer's lost revenue from your outage, and neither pays penalties you agreed to by contract beyond what the law would impose. The table shows each gap and the policy that fills it.

Gap	Why the obvious policy does not respond	What fills it
Your own breach costs under an E&O-only policy	Tech E&O pays customers' claims against you, not your forensics, notification or restoration	Cyber, usually the companion side of the combined form
A customer's lost revenue from your outage under a cyber-only policy	Cyber pays your own recovery costs and privacy liability, not a customer's financial-loss claim	Tech E&O, on the same combined form
Contractual penalties beyond legal liability	Service credits, liquidated damages and uncapped indemnities are promises you made, not liability the law imposes	Negotiate the contract; some Tech E&O forms carve back specific contract obligations
Regulatory fines and penalties	Many are uninsurable by law in the state that imposes them	Cyber forms cover fines only where insurable
Bodily injury and property damage	Excluded from Tech E&O, cyber and D&O	General liability or a BOP
Social engineering and funds-transfer fraud	Not a data breach, so cyber often excludes it; not employee theft, so base crime forms exclude it	A social-engineering endorsement on the crime or cyber policy, usually sublimited
Patent infringement and trade-secret claims	Excluded from most Tech E&O media and IP coverage	Specialty IP coverage

Read the professional-services definition, the contractual liability clause and the data-breach definition together before signing a contract that relies on them.

Contract and certificate requirements

For most SaaS companies the sharpest driver of coverage is the enterprise sales cycle. A master services agreement with a larger customer includes an insurance exhibit that names the required policies, their limits, the additional-insured wording and a certificate to be delivered before go-live, and the security questionnaire usually arrives in the same package.

The exhibit almost always names Technology E&O and cyber, sometimes general liability and crime, with stated limits: a $1 million per-claim floor is common, scaling toward $2 million to $5 million for meaningful enterprise deals. It usually adds the customer as additional insured where the coverage allows and requires a certificate before go-live.

The failure mode is signing agreements whose insurance exhibits your actual policies do not satisfy: a limit that is too low, missing additional-insured language or a coverage trigger that does not match the promised obligation. OnePark Risk reads these agreements against your current policies before you sign, so limits, endorsements and additional-insured wording line up with what you have committed to. Our guides to insurance for enterprise SaaS contracts and insurance requirements in enterprise contracts walk through the clause itself.

What SaaS insurance costs

Venture-backed startups pay median annual premiums of about $2,900 for cyber, $3,700 for Tech E&O, $4,300 for EPLI and $6,300 for D&O (Vouch, 2026). A SaaS company's total depends on revenue, the data it holds, the limits its contracts require, its security controls and its claims history, so the medians orient a budget rather than quote one.

Policy	Median annual premium, venture-backed startups	Source
Cyber	~$2,900	Vouch (2026)
Tech E&O	~$3,700	Vouch (2026)
EPLI	~$4,300	Vouch (2026)
D&O	~$6,300	Vouch (2026)

A vendor handling regulated or highly sensitive data prices above a lightweight productivity tool, because the breach-notification obligation is larger. Ransomware is the loss underwriters model first: Sophos's State of Ransomware research puts the median ransom paid at roughly $1M and average recovery costs around $1.53M, and for a SaaS company an outage also means breached uptime commitments on top of the recovery bill. For the breakdown by stage, read how much startup insurance costs and how much cyber insurance costs.

Cost drivers

ARR and customer count: revenue is the base rating factor, and its enterprise share drives the Tech E&O side.
Records and data types: payment data, health information and other regulated records raise the cyber premium and the notification exposure behind it.
Limits: the limit your contracts require sets the floor, and each step up costs more.
Retention: a higher retention brings the premium down, so pick one you could pay from cash the week a claim arrives.
Controls: multi-factor authentication, endpoint detection, tested and segregated backups and a SOC 2 report; companies that document them consistently see better terms and fewer exclusions.
Claims history: open or paid claims and reported circumstances.

AI exposure note

If your product uses AI or machine learning anywhere, disclose it during underwriting and review how your Technology E&O form treats algorithmic errors, hallucinated or wrong outputs and the intellectual-property questions around training data. Carriers are adding both AI-specific exclusions and AI-specific affirmative coverage, and the difference between forms is widening.

An embedded assistant, a recommendation engine, automated content generation or a model that informs a customer-facing decision all count. Carriers ask how the feature is used, what human review exists and how the model is monitored, and misdescribing any of it is the kind of fact that surfaces in a claim dispute later. Our AI insurance guide covers the forms in detail.

Illustrative examples

Three claims show how the combined form works in practice: a regression that corrupted customer data, an outage that ran past the SLA, and an exfiltrated tenant database. In each, the question is which side of the policy responds, and the answer is simpler when both sides sit on one form with one carrier.

The regression that corrupted customer data

A B2B SaaS platform ships a schema migration that silently mismaps a field for a subset of enterprise tenants. For two weeks the product writes incorrect values into customer records before a client's reconciliation catches it. Several customers demand the cost of restoring their data and the downstream losses their own teams incurred acting on the bad information.

Technology E&O responds to the customers' financial-loss claims, assigns defense counsel and funds the negotiation and any settlement; the incident is documented so the company can meet the notice and remediation obligations its master services agreements require.

The outage that blew through the SLA

A misconfigured infrastructure change takes the platform offline during a customer's peak business hours. The outage runs well past the uptime commitment in the contract, and a large customer claims lost revenue during the window plus the service credits the agreement specifies.

The Technology E&O side of the combined form addresses the customer's claim for financial loss beyond contractual credits and funds the defense; where the incident also involved a security component, the cyber side responds to the response costs, and having both on one form avoids a coverage dispute over which failure came first.

The exfiltrated tenant database

An attacker compromises a developer credential and exfiltrates a database spanning many of the platform's customers, then threatens to publish it. Every affected customer must be notified, and two of them open contractual audit rights and demand a full incident report.

The cyber side of the combined form funds forensics, breach counsel, notification and credit monitoring across the affected customers, responds to third-party liability if data is misused, and covers the business-interruption loss during containment, while producing the documentation customers are entitled to under their agreements.

How OnePark Risk places SaaS insurance

OnePark Risk reads your customer contracts first, builds one combined Tech E&O and cyber submission, and markets it across more than 100 major insurance carriers and excess lines carriers throughout the country. Standard certificates issue the same day once coverage is bound, and we re-read your contracts at each renewal so limits keep pace with the deals you sign.

Contract review. We read the insurance exhibits, liability caps and indemnities in your MSAs, so the submission asks for what your customers require.
One combined submission. Tech E&O and cyber go to market together on one application, with one retention and one claims process; D&O, EPLI, general liability and crime follow as your stage requires.
Broad marketing. We come back with limits, retentions and wording from the markets active in software risk, not a single premium.
Controls-qualified pricing. Companies with a SOC 2 or ISO 27001 report validated through Agency may qualify for OnePark Risk's controls-qualified Cyber and Tech E&O program through Tokio Marine Kiln at Lloyd's of London, subject to eligibility and underwriting.
Same-day certificates. Once the policy is bound, standard certificate requests issue the same day, so a certificate never holds up a go-live.
Renewal stewardship. Before each renewal we re-read the contracts you signed that year and step limits, additional-insured wording and AI language up to match.

Ready to place SaaS insurance? Send us the MSA that requires it. We come back with markets, limits and wording, not a single quote.

Request a Coverage Review · Speak With an Advisor

Licensed in New York, California, Delaware, Massachusetts, Pennsylvania, New Jersey, Nevada, Florida, and Virginia.

SaaS insurance by state

Where a SaaS company employs people and holds data changes the compliance questions underwriters ask: California's CCPA and CPRA privacy duties, Massachusetts's 201 CMR 17.00 written security program, and New York's SHIELD Act security duties, plus each state's workers' compensation rules. The state guides below cover what changes in each.

Insurance for SaaS companies in California: CCPA/CPRA privacy duties and California employer rules.
Insurance for SaaS companies in Massachusetts: 201 CMR 17.00 WISP requirements and Massachusetts employer rules.
Insurance for SaaS companies in New York: SHIELD Act security duties and New York employer rules.

Related coverages

SaaS insurance is a program, and each policy in it has its own guide. Tech E&O covers the product failing, cyber for startups covers your own breach costs and the privacy claims that follow, D&O covers founders and directors in investor disputes, and the startup insurance overview shows how the stack grows by stage.

Tech E&O insurance: What it covers, who needs it and what it costs.
Cyber insurance for startups: Your own breach costs and the privacy claims that follow.
D&O insurance for startups: When investors require it and what it costs.
Startup insurance: The full program, stage by stage.

Frequently asked questions

What insurance does a SaaS company need?

Most SaaS companies need Tech E&O and cyber, usually on one combined policy. They add D&O once they raise a priced round or seat outside directors, EPLI once they hire, and general liability or a BOP for leases and events. Enterprise customers often make Tech E&O and cyber a condition of signing.

How much does SaaS insurance cost?

Venture-backed startups report median annual premiums of about $2,900 for cyber, $3,700 for Tech E&O, $4,300 for EPLI and $6,300 for D&O (Vouch, 2026). Your total depends on revenue, the data you hold, the limits your contracts require and your security controls.

Do SaaS companies need Tech E&O and cyber as separate policies?

Usually not. Most SaaS companies buy a combined Tech E&O and cyber form, because a single incident such as an outage or breach can cause both customer financial losses and your own response costs. Separate towers can make sense at larger limits.

What limits do enterprise customers require?

A $1 million per-claim floor is common, scaling toward $2 million to $5 million for meaningful enterprise deals. Customers often also ask to be added as additional insured and want a certificate before go-live.

Does SaaS insurance cover a data breach?

Cyber insurance covers your breach response costs (forensics, notification, restoration, extortion) and third-party privacy claims. Tech E&O covers customer losses from your service failing. You need both to cover a breach end to end.

Does a SOC 2 report lower SaaS insurance premiums?

Strong, documented controls generally improve your underwriting outcome. Companies validated through Agency may qualify for OnePark's controls-qualified Cyber and Tech E&O program, subject to eligibility and underwriting.

Is "software company insurance" different from SaaS insurance?

The coverage stack is the same: Tech E&O, cyber, D&O, EPLI and GL. What changes is the exposure. On-premise software leans more on product-failure E&O, and SaaS adds uptime, multi-tenant data and SLA risk.

Your AI assistant can request this coverage

An AI agent or assistant acting for your business can request this coverage from OnePark: it uses the same browser forms a person does, and no MCP server, API key, or integration is required. The agent cannot bind coverage, and submitting a request does not guarantee carrier approval or a quote. Your business’s authorized representative approves any purchase in writing.

Business insurance for AI agents · Your AI assistant can now request business insurance from OnePark · How it works for agent builders

Sources

This material is general educational information, not legal, tax, or insurance advice. Coverage availability, policy terms, and regulatory requirements vary by state, carrier, and applicant.