# Business Insurance for SaaS Startups: What You Need and When > Business insurance for SaaS startups: which policies a bootstrapped founder needs (tech E&O, cyber, liability, D&O), what triggers each, and what it costs. - Canonical: https://zeroraised.com/blog/business-insurance-for-saas-startups - Published: 2026-11-12T11:30:00Z - Author: ZeroRaised Team (https://zeroraised.com/blog/authors/zeroraised) - Publisher: ZeroRaised (https://zeroraised.com/) - Section: Building - Tags: saas, legal, checklist, solo-founders **Short answer:** A bootstrapped SaaS usually needs no insurance on day one beyond what the law requires. Buy professional indemnity (tech E&O) and cyber when your first B2B customer contract asks for it or when you start holding sensitive customer data. Employers' liability becomes compulsory in the UK with your first employee. D&O and key-person cover can usually wait until investors, a board or a lender ask for them. Every price, legal rule and quote below comes from the insurer's, regulator's or government's own page, checked on 12 Nov 2026. The stage-by-stage advice is ours and is marked as such. ## TL;DR - **Tech E&O and cyber are the core SaaS policies.** E&O covers claims that your product or service caused a client a loss. Cyber covers breaches and attacks. - **Contracts are the usual trigger.** Larger buyers set minimum cover in their contracts. Read the insurance clause before you sign, not after. - **UK employers' liability is compulsory from your first hire.** You need at least £5 million of cover, and GOV.UK says the fine is £2,500 for every day you are not properly insured ([GOV.UK](https://www.gov.uk/employers-liability-insurance)). - **US workers' comp is a state question.** The US Department of Labor sends private employers to their state workers' compensation board ([DOL](https://www.dol.gov/general/topic/workcomp)). - **Entry prices are low, but quotes vary.** UK software PI is advertised from £6.95 a month ([Simply Business](https://www.simplybusiness.co.uk/business-insurance/software-company-insurance/)), and Next says 73% of its customers pay $45 or less per month for E&O ([ERGO NEXT](https://www.nextinsurance.com/errors-and-omissions-insurance/cost/)). **Disclosure:** ZeroRaised is a launch site for bootstrapped products. It has no commercial relationship with any insurer, broker or vendor named here and earns nothing if you buy a policy. **This is not insurance, legal or financial advice.** Policies differ by insurer, country and wording, so read the policy documents and speak to a licensed broker before you buy. ## Your contract is your first line of defence Insurance pays for a claim after it happens. Your terms decide how big that claim can get. Before you spend anything on premiums, make sure your terms of service cap your liability, disclaim implied warranties where the law allows, and exclude indirect losses. Our guide on [how to write terms of service for a SaaS](https://zeroraised.com/blog/how-to-write-terms-of-service-for-a-saas) covers the limitation of liability clause. Our read: a clean liability cap often does more for a solo founder than a policy does. ## The policies, in plain English ### Tech E&O / professional indemnity This matches how SaaS businesses actually get sued: a customer says your software failed or did not do what you promised, and they lost money. In the UK it is sold as professional indemnity (PI). Simply Business describes its PI as cover for software professionals "against claims for negligence and loss-causing errors" ([Simply Business](https://www.simplybusiness.co.uk/business-insurance/software-company-insurance/)). **What it costs (published figures only):** - Simply Business (UK) advertises PI for software professionals "from £6.95" a month. The footnote says the price is for up to £1 million of PI, and that "10% of software engineers paid £83.42 or less annually" between 1 April and 30 September 2026. So it is the cheapest decile, not an average. - The same page shows a real online quote created on 20/04/2026 for a sole trader with no employees: £441.17 a year for £1,000,000 PI, £5,000,000 public liability, £10,000,000 employers' liability and £4,000 portable equipment cover ([Simply Business](https://www.simplybusiness.co.uk/business-insurance/software-company-insurance/)). - ERGO NEXT (US) says "73% of customers pay $45 or less per month for E&O insurance", and that for some lower-risk businesses E&O "can cost as little as $19 per month". Its data covers US customers who bought cover over the previous 12 months and was updated in April 2026 ([ERGO NEXT](https://www.nextinsurance.com/errors-and-omissions-insurance/cost/)). That page does not break out software companies, so a SaaS quote may land elsewhere. ### Cyber insurance Cyber covers your own costs after an attack or breach (incident response, recovery, notification) and your liability to people whose data was exposed. If you store customer data, process payments or hold credentials to customers' systems, this is the second policy to price. Do not count on liability cover here: Hiscox UK's public liability page excludes "Claims related to any cyber attack or transmission of a computer virus" ([Hiscox UK](https://www.hiscox.co.uk/business-insurance/public-liability-insurance)). Our read: buy E&O and cyber together where you can, because one incident, such as a breach that also takes a customer offline, can touch both. ### General / public liability This covers injury to people and damage to their property caused by your business. Hiscox UK says it covers "compensation and legal defence costs" if a client or member of the public takes legal action against you. It advertises cover "from £5.20" per month, a figure its footnote bases on public liability policies sold between August 2025 and August 2026 ([Hiscox UK](https://www.hiscox.co.uk/business-insurance/public-liability-insurance)). Our read: for a remote SaaS you will mostly buy this because a lease, venue or customer contract requires it. ### Employers' liability (UK) and workers' comp (US) In the UK, GOV.UK says you must get employers' liability insurance "as soon as you become an employer", from an authorised insurer, "to cover you for at least £5 million". It also says "You can be fined £2,500 every day you are not properly insured", and that if you do not display your certificate where employees can access it, "you could be fined £1,000". You do not need it if you only employ a family member or someone based outside England, Scotland and Wales ([GOV.UK](https://www.gov.uk/employers-liability-insurance)). In the US, workers' compensation for private employers is handled state by state. The Department of Labor says people injured at work for private companies "should contact their state workers' compensation board" ([DOL](https://www.dol.gov/general/topic/workcomp)), and it keeps a directory of each state's workers' compensation office ([DOL OWCP](https://www.dol.gov/agencies/owcp/wc)). Check your state's own page before your first hire. Our [first employee guide](https://zeroraised.com/blog/how-to-hire-your-first-employee-as-a-bootstrapped-founder) covers the rest of that checklist. ### D&O (directors and officers) D&O protects directors and officers personally when they are sued over how the company was run. Embroker says it "can help cover legal defense costs, settlements, and judgments tied to claims of mismanagement" and that "Startups may need D&O insurance to attract investors or advisors". It also says D&O "typically does not cover intentional misconduct, fraud, criminal acts" ([Embroker](https://www.embroker.com/coverage/directors-and-officers-insurance/)). Our read: the people most likely to sue directors are outside shareholders. A company owned only by its founders has few of them, so D&O can usually wait until you take outside money, add an independent board member or bring on advisors who ask for it. ### Key-person insurance Embroker describes key-person insurance as cover "purchased by a business to insure the life of one of the company's most vital employees", and notes that "Pressure to purchase key person policies often comes from investors" ([Embroker](https://www.embroker.com/coverage/key-person-insurance/)). Our read: with no lender or investor, it is rarely a solo founder's first purchase. ## What to buy at each stage This table is our editorial view, not a rule. Contracts and local law come first. | Stage / trigger | Buy now | Usually wait | |---|---|---| | Pre-revenue, solo, no employees | Nothing compulsory in most cases; fix your terms of service | E&O, cyber, D&O | | First self-serve paying customers (small B2C or prosumer) | Consider cyber if you hold personal or payment data | D&O, key-person | | First B2B contract that names insurance | Tech E&O / PI and cyber at the limits the contract requires | D&O | | Storing sensitive customer data or credentials | Cyber, and check the E&O wording covers data loss | Key-person | | First employee | UK: employers' liability (compulsory). US: workers' comp per your state's rules | D&O | | Office lease, coworking or in-person events | General / public liability if the lease or venue requires it | | | Enterprise or government deals | Higher E&O, cyber and liability limits as the contract states | | | Outside investors, a board, or a bank loan | D&O; key-person if a lender or investor asks | | ## How enterprise and government contracts set your insurance Bigger customers write minimum cover into the contract. US federal rules show how specific this gets. FAR 52.228-5 requires a contractor to carry "at least the kinds and minimum amounts of insurance required in the Schedule or elsewhere in the contract" and to tell the contracting officer in writing before work starts that it has done so ([FAR 52.228-5](https://www.acquisition.gov/far/52.228-5)). For cost-reimbursement contracts, FAR 28.307-2 sets floors such as "Employer's liability coverage of at least $100,000" and general liability "of at least $500,000 per occurrence" ([FAR 28.307-2](https://www.acquisition.gov/far/28.307-2)). A standard SaaS subscription will not always trigger these clauses, but they show the pattern: the buyer names the policy types and the amounts, and you supply the proof. Our guide on [how to sell software to the government](https://zeroraised.com/blog/how-to-sell-software-to-the-government) covers the wider procurement process. Our read on private enterprise deals: the insurance clause is often negotiable. If a buyer asks for limits you cannot afford, ask whether a lower limit or a liability cap tied to fees paid is acceptable first. ## What cyber underwriters ask about Coalition, a cyber insurer, lists five ways to meet cyber coverage requirements: "Multi-factor authentication", "Cybersecurity training", "Maintain good data backups", "Identity access management" and "Enforcing data classification". It adds "Antivirus or Endpoint Detection and Response (EDR) software" under additional requirements ([Coalition](https://www.coalitioninc.com/topics/5-essential-cyber-insurance-requirements)). The UK's National Cyber Security Centre notes that buying a policy "might require providing information about your security controls" ([NCSC](https://www.ncsc.gov.uk/guidance/cyber-insurance-guidance)). A short pre-quote checklist built from those sources: - [ ] MFA on email, cloud consoles, code hosting and admin panels - [ ] Backups with redundancy, kept separate from your production network - [ ] Staff security training, even if "staff" is you plus a contractor - [ ] Least-privilege access and a list of who can reach which data - [ ] Antivirus or EDR on every work laptop - [ ] A written note of what customer data you hold and where (your privacy policy is a good starting inventory) Answer the proposal form accurately. NCSC warns that "The onus is on you to ensure that your organisation's cyber security details are accurate and up to date." ## How to buy: online insurer or broker **Online insurers and comparison sites** (Hiscox, Simply Business and ERGO NEXT are examples) suit a solo founder buying standard PI and public liability at modest limits: fill in a form, get a price. **A broker** earns their fee when a contract asks for unusual wording (named additional insureds, waivers of subrogation, cyber sub-limits), high limits, or cover for regulated industries. Our read: start online, and move to a broker the first time an enterprise insurance clause confuses you. Either way, check that the policy responds to claims in the countries where your customers are, ask what happens to claims reported after you cancel (E&O and cyber are often claims-made), and match limits to your largest contract, not your revenue. ## Exclusions to watch - **Business email compromise.** NCSC warns "some insurance policies will not cover monies lost through business email compromise fraud" ([NCSC](https://www.ncsc.gov.uk/guidance/cyber-insurance-guidance)). - **Deliberate acts.** D&O "typically does not cover intentional misconduct, fraud, criminal acts" ([Embroker](https://www.embroker.com/coverage/directors-and-officers-insurance/)). - **Your own staff and property on public liability.** Hiscox UK lists "Injury to your employees or damage to your own property" as not covered ([Hiscox UK](https://www.hiscox.co.uk/business-insurance/public-liability-insurance)). That is what employers' liability and contents cover are for. NCSC's advice applies to every policy here: "Make sure you understand in detail what the policy covers, and equally important, what is excluded." ## A worked example (illustrative) *Example, our assumptions:* a UK sole trader running a B2B SaaS, no employees, signs a first agency customer whose contract asks for £1 million PI and £1 million public liability. - Simply Business's advertised PI floor is £6.95 a month for up to £1 million of PI, which its footnote ties to the cheapest 10% of buyers paying £83.42 or less a year. - A fuller real quote on the same page (sole trader, £1m PI, £5m public liability, £10m employers' liability, £4,000 equipment) was £441.17 a year. Our read: budget somewhere between those two figures for the core cover, add cyber if you hold the customer's data, and get your own quote before you price the deal. Once you hire, employers' liability becomes compulsory, as covered above. ## Frequently asked questions ### Do I need business insurance for a SaaS with no customers yet? Usually not, unless the law requires it. Before revenue, the common legal trigger is having employees: employers' liability in the UK, and workers' compensation under your state's rules in the US. Most founders buy professional indemnity (tech E&O) and cyber when their first B2B customer asks for proof of cover, or when they start holding meaningful customer data. ### What is the difference between tech E&O and cyber insurance? Tech E&O (called professional indemnity in the UK) covers claims that your software or service failed and caused a client a financial loss, such as a bug, an outage or a missed obligation. Cyber covers breaches and attacks: incident response, data recovery and liability to people whose data was exposed. Many insurers sell them together because SaaS claims often involve both. ### How much does insurance cost for a small SaaS? Quotes vary with revenue, limits, data held and claims history, so treat published figures as floors. Simply Business advertises professional indemnity for software professionals from £6.95 a month for up to £1 million of cover, based on the cheapest 10% of buyers between April and September 2026. ERGO NEXT says 73% of its customers pay $45 or less per month for E&O. ### Is employers' liability insurance compulsory for a UK SaaS company? Yes, as soon as you become an employer, unless an exemption applies. GOV.UK says you need at least £5 million of cover from an authorised insurer, you can be fined £2,500 for every day you are not properly insured, and you could be fined £1,000 for not displaying the certificate. You do not need it if you only employ a family member or someone based outside England, Scotland and Wales. ### When does a bootstrapped startup need D&O insurance? Usually when someone outside the founders has a stake in how the company is run: investors, a board or outside advisors. Embroker says startups may need D&O insurance to attract investors or advisors. Our read: a founder-owned company with no outside shareholders can usually wait until one of those people asks. ## Covered? Now launch Insurance is one line on the pre-launch list. Our [product launch checklist for bootstrapped makers](https://zeroraised.com/blog/product-launch-checklist-for-bootstrapped-makers) covers the rest. When you are ready, [submit your product to ZeroRaised](https://zeroraised.com/submit) for free, and [join the ZeroRaised newsletter](https://zeroraised.com/newsletter) for more guides on building without investors. ## Sources - [GOV.UK: Employers' liability insurance](https://www.gov.uk/employers-liability-insurance), last checked 12 Nov 2026 - [US Department of Labor: Workers' compensation](https://www.dol.gov/general/topic/workcomp), last checked 12 Nov 2026 - [US Department of Labor OWCP: State workers' compensation officials](https://www.dol.gov/agencies/owcp/wc), last checked 12 Nov 2026 - [Simply Business: Software company insurance](https://www.simplybusiness.co.uk/business-insurance/software-company-insurance/), last checked 12 Nov 2026 - [ERGO NEXT: Errors and omissions insurance cost](https://www.nextinsurance.com/errors-and-omissions-insurance/cost/), last checked 12 Nov 2026 - [Hiscox UK: Public liability insurance](https://www.hiscox.co.uk/business-insurance/public-liability-insurance), last checked 12 Nov 2026 - [Embroker: Directors and officers insurance](https://www.embroker.com/coverage/directors-and-officers-insurance/), last checked 12 Nov 2026 - [Embroker: Key person insurance](https://www.embroker.com/coverage/key-person-insurance/), last checked 12 Nov 2026 - [Coalition: 5 essential cyber insurance requirements](https://www.coalitioninc.com/topics/5-essential-cyber-insurance-requirements), last checked 12 Nov 2026 - [NCSC: Cyber insurance guidance](https://www.ncsc.gov.uk/guidance/cyber-insurance-guidance), last checked 12 Nov 2026 - [FAR 52.228-5: Insurance, work on a Government installation](https://www.acquisition.gov/far/52.228-5), last checked 12 Nov 2026 - [FAR 28.307-2: Liability](https://www.acquisition.gov/far/28.307-2), last checked 12 Nov 2026 ## Frequently asked questions ### Do I need business insurance for a SaaS with no customers yet? Usually not, unless the law requires it. Before revenue, the common legal trigger is having employees: employers' liability in the UK, and workers' compensation under your state's rules in the US. Most founders buy professional indemnity (tech E&O) and cyber when their first B2B customer asks for proof of cover, or when they start holding meaningful customer data. ### What is the difference between tech E&O and cyber insurance? Tech E&O (called professional indemnity in the UK) covers claims that your software or service failed and caused a client a financial loss, such as a bug, an outage or a missed obligation. Cyber covers breaches and attacks: incident response, data recovery and liability to people whose data was exposed. Many insurers sell them together because SaaS claims often involve both. ### How much does insurance cost for a small SaaS? Quotes vary with revenue, limits, data held and claims history, so treat published figures as floors. Simply Business advertises professional indemnity for software professionals from £6.95 a month for up to £1 million of cover, based on the cheapest 10% of buyers between April and September 2026. ERGO NEXT says 73% of its customers pay $45 or less per month for E&O. ### Is employers' liability insurance compulsory for a UK SaaS company? Yes, as soon as you become an employer, unless an exemption applies. GOV.UK says you need at least £5 million of cover from an authorised insurer, you can be fined £2,500 for every day you are not properly insured, and you could be fined £1,000 for not displaying the certificate. You do not need it if you only employ a family member or someone based outside England, Scotland and Wales. ### When does a bootstrapped startup need D&O insurance? Usually when someone outside the founders has a stake in how the company is run: investors, a board or outside advisors. Embroker says startups may need D&O insurance to attract investors or advisors. Our read: a founder-owned company with no outside shareholders can usually wait until one of those people asks.