SaaS & software companies insurance checklist: what a software company should carry

The software company insurance checklist

QUICK ANSWER

SaaS & software companies usually carry technology e&o, cyber liability and general liability. Software companies sell products under service-level agreements, hold customers' data in the cloud, raise capital from investors who require directors and officers coverage, and sign enterprise contracts that assume a much larger vendor. The client's vendor desk and the lender ask for proof of each. The checklist below says what every item does, who requires it and how to check it on the policies you already have.

Reviewed by Michael LaBarbera, Licensed property & casualty agent, Provident Financial Group · Reviewed Oct 12, 2026 Updated Oct 14, 2026

Who asks a software company for what

Who	What they usually want to see
Enterprise clients & vendor onboarding	General liability, professional or cyber liability, workers' compensation and often an umbrella
Banks, lenders & SBA loans	Property or auto physical damage with the lender as loss payee, and liability proof at closing and every renewal
Landlords & commercial leases	General liability with the landlord as additional insured, property coverage on tenant improvements and workers' compensation

Each of them wants a certificate, and most want it again at every renewal. A live certificate link from the wallet shows today's coverage to every holder and tells them when it changes.

How to check what you already have

Technology E&O declarations. The retroactive date, whether cyber coverages are included in the same form, contractual liability wording and the exclusions for guarantees of uptime.
Cyber declarations. The headline limit matters less than the sublimits: social engineering, funds-transfer fraud, ransomware and business interruption, plus the regulatory coverage and the panel of breach vendors.
General liability declarations page. Three liability numbers matter: each occurrence, general aggregate and the products–completed operations aggregate. Then the forms list: blanket additional insured, waiver of subrogation and primary and non-contributory wording satisfy every contract; scheduled forms satisfy one.
Directors and officers declarations. Entity coverage, employment practices if packaged, the retention, and the exclusions for prior and pending matters.
Employment practices declarations. Limit and retention, third-party coverage for claims by customers, and whether wage-and-hour claims carry any defence sublimit.
Workers' compensation information page. Item 3.A must list every state you work in, item 4 must carry the right class codes, and the employers' liability limits should meet what contracts ask. Check that the estimated payroll is close to this year's.
Crime declarations. Employee theft, forgery, funds-transfer fraud and social engineering each have their own limit; third-party coverage if you work in clients' premises.

What usually goes wrong for SaaS and software companies

Enterprise contracts with uptime guarantees and unlimited indemnity for data breaches.
Investors' D&O requirements met late, after the round closed.
Contracts that promise uptime or indemnity the policy excludes.
Social engineering (wire fraud) sublimited to a small amount on a cyber policy with a large headline limit.
A fidelity limit below what lenders and the statute require for the funds on hand.
A management company not named on the fidelity bond that handles the account.

What underwriters will ask a software company

Customers and contract terms, data held and where, revenue and headcount, and investor requirements
Services, SLAs offered and the largest client contract
Security controls and whether you hold client credentials or data
Multi-factor authentication, backups and endpoint protection
Records held, payment card handling and any client network access
Number of units, reserves on hand and who manages the money

Have the answers in the wallet before the renewal and the quote request fills itself in; CoverMatch sends one application to every eligible carrier and lines the quotes up against what you have.

Renewal timing

Workers' compensation is audited on actual payroll and liability on sales, so a busy year ends with a bill unless the estimates were kept honest; pay-as-you-go billing through your payroll company removes most of that. Renewal autopilot starts the comparison sixty days out, prefilled from the wallet.

Questions people actually ask

What does technology E&O cover for a SaaS company?

Claims that the software failed, the service was down or an error cost a customer money, including contractual claims under the SLA where the policy allows. It is usually packaged with cyber, because an outage and a breach are often one event.

Why do investors require D&O?

Because directors and officers are personally exposed for decisions, disclosures and employment claims, and investors will not take board seats without it. Most term sheets require it at closing.

What is the difference between tech E&O and cyber?

Tech E&O responds when your product or service fails and a client loses money. Cyber responds when data or systems are compromised, yours or a client's. Most carriers package them for technology businesses because one incident usually triggers both.

Does cyber insurance cover a fraudulent wire transfer?

Only under a social-engineering or funds-transfer-fraud insuring agreement, and often at a sublimit well below the policy limit. Ask for the sublimit before you buy; it is the claim small businesses actually have.

Why does the lender ask about the association's fidelity bond?

Because mortgage guidelines require the association to insure its funds against theft by officers, directors and the manager, usually at a stated multiple of reserves plus dues. It is a condition of unit financing, which is why the lender's certificate request names it.