Technology Insurance

What insurance does a startup need? The standard stack by requirement source

Seven policies make up the standard stack, and most seed-stage software companies we place hold all seven within 18 months of formation. Workers’ comp is required by law. The other six are required by somebody: the landlord who wants a certificate before you get keys, the investor whose term sheet says “D&O in force at closing,” the customer whose MSA demands $5M of E&O and cyber.

Startup business insurance by stage: typical limits and annual premium, pre-seed to Series B

This is the table founders ask us for and no carrier publishes: the limit a company at each stage is usually asked to carry, and the annual premium range we see when we place it. Figures are for US software companies. Hardware, fintech, healthtech, and AI run higher; see below.

One caveat: our placement data thins at Series B and beyond, where premium follows valuation, revenue, and litigation history. Treat that column as a floor.

Three lines flip from optional to mandatory at predictable moments:

The closing conditions say so, and the incoming director takes the seat once it is bound.

Statute is silent; the economics are loud. Per the EEOC, the agency received 88,531 discrimination charges in FY2024. One defended charge costs more than several years of seed-stage premium.

The security questionnaire arrives before the MSA, and the MSA arrives with an insurance exhibit.

Holding a term sheet or a customer contract right now? Send us the document and we will tell you what it actually requires. It is often less than it appears.

What insurance do investors require before they wire? D&O limits by round

Your lead investor requires D&O for one reason: the person joining your board is exposing their personal assets to claims from your other shareholders, your employees, and regulators. Your policy responds first; the fund’s sits behind it.

Side A, in two sentences: it is the part of a D&O policy that pays a director or officer directly when the company cannot indemnify them, most often in bankruptcy or a derivative suit. Investors care because it is the only layer that protects them personally once the company has run out of money.

D&O has to be in force before the wire moves. Miss that and the closing slips, or it lands with a covenant and a deadline. We have bound D&O the morning of a closing more than once. Give yourself a week instead. A quote takes 48 to 72 hours for a standard software risk; the private company D&O page covers the underwriting questions and how limits scale by round.

Most seed-stage companies buy D&O inside a management liability package with EPLI and crime on one form. It costs less than three standalone policies and gives you one renewal date. The management liability insurance page covers the tradeoffs, including the shared limit.

General liability insurance for startups: limits, BOP vs standalone, typical cost

The landlord asks first. Almost every commercial lease and coworking agreement requires $1M per occurrence and $2M aggregate general liability, with the landlord named as additional insured, before you get a key card. GL is the first policy most founders buy, and the cheapest: $250 to $1,200 a year for a pre-seed or seed software company. Most founders who come to us with a lease in hand were first offered a BOP instead.

GL covers bodily injury and property damage you cause to third parties, plus personal and advertising injury such as libel or copyright infringement in your ads. Your software failing, your data getting stolen, and your employee suing you all sit outside it.

A business owners policy (BOP) bundles GL with property coverage and a slice of business interruption. For a coffee shop, a BOP is the right product. For a software company with three laptops and no inventory, it is usually the wrong one: you pay for property coverage sized for a storefront, and the professional and cyber exclusions sit exactly where your real exposure lives. Some carriers sell a “tech BOP” with cyber and E&O endorsements. Read the sublimits. A $50,000 cyber sublimit fails an MSA that asks for $2M. Buy standalone GL, name the landlord, and spend the savings on E&O.

Cyber insurance for startups: purchase triggers, underwriter control requirements, cost by revenue band

The trigger is almost always the first customer security questionnaire. Procurement sends a 200-question spreadsheet, and question 140 asks whether you carry cyber insurance and at what limit. The MSA that follows puts a number on it: $1M to $2M at first, $2M to $5M in regulated industries.

Underwriters price cyber for startups on controls more than revenue. Five controls decide whether you get a quote, and at what price:

• Multi-factor authentication on email, remote access, and admin accounts. All three, or most carriers decline.
• Endpoint detection and response (EDR) on every laptop.
• Backups that are offline or immutable, tested within the last year.
• Email filtering plus a written funds-transfer verification procedure.
• Separate admin accounts for anyone with production access.

Per IBM’s Cost of a Data Breach Report 2024, the global average breach cost $4.88M. A small breach at a seed-stage company still runs $150,000 to $400,000 in forensics, notification, and legal cost. That is what the first $1M of limit buys.

Typical annual premium by revenue band, with those controls in place:

• Under $1M revenue: $750 to $3,000 for $1M to $2M of limit
• $1M to $5M revenue: $3,000 to $15,000 for $2M to $3M of limit
• $5M to $20M revenue: $15,000 to $40,000 for $3M to $5M of limit

The cyber liability insurance page covers first-party versus third-party coverage, sublimits, and ransomware. The cyber insurance requirements page walks through the underwriters’ control checklist and how to close each gap before you apply.

Tech E&O, EPLI, crime, and workers’ comp for startups: when each becomes a requirement

Tech E&O becomes a requirement when a customer can lose money because your product failed. An outage that costs a customer a day of sales, a pipeline that corrupts their records, an API that returns the wrong answer: these are E&O claims. GL excludes every one. Most carriers write tech E&O and cyber on one combined form, which is cheaper and stops two carriers arguing over who pays. Standalone tech E&O runs $3,000 to $15,000 a year from seed to Series A. The tech E&O page covers claims-made structure, retroactive dates, and contract language.

EPLI becomes a requirement at your first termination. Defending one employment claim through summary judgment costs $75,000 to $150,000 in our experience; a seed-stage EPLI policy costs $1,000 to $5,000 a year. In California, the wage-and-hour sublimit is the part that gets used. The EPLI page covers retention structure and why a written handbook lowers the premium.

Crime becomes a requirement when your controller can move money. The crime claim we see most in startups is funds-transfer fraud: a spoofed email from the CEO asks finance to wire $80,000 to a new vendor. Most cyber policies sublimit that at $100,000 or less. Crime runs $1,000 to $2,500 a year at seed.

Workers’ compensation is required by statute, in most states at the first W-2 employee; some exempt officer-owners, and a few set a threshold of three to five employees. Premium is a rate per $100 of payroll, and software class codes are cheap: a 15-person company pays $1,500 to $5,000 a year. Skipping it is a misdemeanor in most states.

How much does startup business insurance cost? Three worked scenarios

Three profiles from placements we made in the last 18 months, rounded. Between them they describe most of the software companies in our book.

Five-person pre-seed SaaS, remote team, $400K raised on SAFEs. GL at $1M/$2M for the coworking lease: $600. Combined cyber and tech E&O at $1M, because the first design partner asked: $2,800. Workers’ comp for three W-2 employees: $900. Total: about $4,300 a year. D&O waits for a priced round and a board.

15-person seed SaaS, $3M priced round closed, first enterprise customer signed. GL: $1,100. Combined cyber and tech E&O at $2M, required by the MSA: $6,500. Management liability package with $2M D&O, $1M EPLI, $500K crime, required by the lead investor: $8,900. Workers’ comp: $2,600. Total: about $19,100 a year. The D&O package is nearly half the bill.

40-person Series A in California, $15M raised, selling into healthcare and financial services. GL: $2,500. Cyber at $3M and tech E&O at $5M on one form, required by two customer MSAs: $18,000. D&O at $5M with Side A: $20,500. EPLI at $2M with a wage-and-hour sublimit: $4,800. Crime at $1M: $2,400. Workers’ comp on $6M of payroll: $11,000. Umbrella at $5M: $3,500. Total: about $60,000 a year.

The gap between $4,300 and $55,000 is who is asking. Headcount matters less. The first company has a landlord and a design partner. The third has a board, two regulated-industry customers, and California employment law. Each new party adds a line, priced on the limit that party demanded.

When your first enterprise customer’s MSA requires $5M limits

The insurance exhibit in an enterprise MSA is a template the customer’s risk department wrote for vendors of every size. It asks for $5M of E&O, $5M of cyber, $2M of GL, additional insured status, waiver of subrogation, and 30 days’ notice of cancellation. Some of that is negotiable. Some of it can be met with a follow-form umbrella over a $2M primary, at a fraction of the cost of $5M primary. We have walked dozens of seed and Series A companies through this exact exhibit.

The full breakdown, including which clauses to push back on and the language that satisfies a $5M requirement without a $5M policy, lives on the startup insurance for enterprise contracts page. Read it before you sign. Where an umbrella is the answer, the excess liability for tech companies page covers how the tower attaches.

Insurance for tech startups vs hardware, fintech, healthtech, and AI startups

Everything above assumes a software company. Four kinds of startup need a different stack, and usually a different carrier. These four generate most of our calls.

Hardware and CPG startups add product liability the day a unit ships, and product recall once a retailer is involved. Sell through big-box or marketplace channels and the vendor agreement sets your limits for you. The big-box retailer insurance requirements page covers what Walmart, Target, and Amazon require of CPG and DTC brands.

Fintech startups need E&O that covers financial services as well as technology, and often a fidelity bond for money movement. Banking partners dictate limits, and many SaaS carriers decline a money transmitter outright.

Healthtech startups that touch patient care need professional liability for the clinicians on the platform as well as tech E&O for the software. A company that connects patients to licensed providers carries malpractice exposure in every state where a patient sits. The telemedicine malpractice insurance page covers licensure compacts, platform contract requirements, and how malpractice and tech E&O fit together.

AI startups face exclusions that are three years old at most. Tech E&O and cyber forms increasingly carve out claims from model output, training data, and algorithmic discrimination. The insurance for AI companies page covers which carriers write affirmative AI coverage and what they ask about model governance.

Five startup insurance mistakes underwriters and investors see most

Buying a BOP for a software company. The property coverage goes unused and the exclusions leave your real exposure bare. Buy standalone GL and spend the difference on E&O.

Letting D&O lapse between rounds. A gap in claims-made coverage leaves any claim from the gap period uninsured forever. Renew on time. Confirm the retroactive date carries forward.

Claims-made coverage without a tail. Switch carriers or wind down without extended reporting, and claims from prior work have nowhere to go. Budget one to two years of premium for it.

Under-insuring cyber sublimits. A $2M cyber policy with a $100,000 funds-transfer sublimit and a $250,000 ransomware sublimit is a $250,000 policy for the two likeliest claims. Read the declarations page.

Naming the wrong entity. Insure the Delaware parent while the operating subsidiary signed the MSA, and the claim lands on an uninsured company. List every entity. Update the schedule when you restructure.

What Alliance Risk needs to quote startup business insurance: documents, timeline, and process

Quotes for standard software risks come back in 48 to 72 hours. Hardware, fintech, healthtech, and AI companies take five to ten business days, because the markets are narrower. Have ready:

• Legal entity names and states of formation, including subsidiaries
• Headcount and payroll by state
• Trailing and projected twelve-month revenue
• Total raised, last round date, and board composition
• The lease, term sheet, or MSA exhibit that triggered the request
• For cyber: a yes or no on MFA, EDR, and backups

Frequently asked questions

Yes, in both senses. Premiums are a deductible ordinary business expense in the year paid. For budgeting, expect $3,000 to $7,000 a year at pre-seed and $12,000 to $20,000 at seed for a software company, rising as investors and customers add requirements.

Usually one policy: general liability, because your lease or coworking agreement requires it. Everything else waits for a trigger. Workers’ comp starts with the first W-2 hire. D&O starts with the priced round. Cyber and E&O start with the first enterprise customer.

The stack matched to whoever is asking. For a seed-stage software company that means GL at $1M/$2M, combined cyber and tech E&O at $1M to $2M, and a management liability package with D&O, EPLI, and crime. Add workers’ comp at the first W-2 employee.

A pre-seed software company pays $3,000 to $7,000 a year. A seed-stage company with a priced round and an enterprise customer pays $12,000 to $20,000. A Series A company in California pays $30,000 to $60,000. D&O is the largest line once a board exists.

Before the priced round, rarely. At the priced round, almost always, because the closing conditions require it and the incoming director takes the seat once it is bound. Bind it a week before the expected close; a quote takes 48 to 72 hours for a standard software risk.

If everyone is a founder-owner paid in equity, most states exempt you. The day you pay a W-2 employee, even part-time, most states require coverage. Contractors reclassified as employees and remote hires in other states both create new obligations. Check the state where the worker sits.

Side A pays directors and officers directly when the company cannot indemnify them, most often in bankruptcy or a derivative suit. It carries no retention. Investors at Series B and beyond often require dedicated Side A excess limits above the main tower, because it is the only layer that protects them personally.

The earliest date of work the policy will cover. Claims arising from services performed before that date are excluded, even if the claim arrives during the policy period. When you switch carriers, the new policy must carry the original retroactive date forward or you lose coverage for prior work.

Yes. AWS secures the infrastructure; you are responsible for your application, your credentials, your laptops, and your customers’ data. A phished admin password or a misconfigured storage bucket is your breach. Customer MSAs require cyber coverage whatever your cloud provider.

A new round usually means a limit increase and a mid-term endorsement adding the new director. An acquisition triggers the change-in-control clause: the policy converts to run-off, covering only pre-closing acts, and you buy a tail, typically six years, as a condition of the merger agreement.

Get Startup Business Insurance from Alliance Risk

A startup insurance program is a set of policies that changes every time a new party makes a demand of you. It fails at three predictable points: the priced round closes without D&O in force, a customer MSA gets signed with an exhibit nobody read, and a carrier change resets a retroactive date and strips coverage for every prior year.

Coverage is half of it. Underwriters price the other half on how you run the company: MFA and EDR on every endpoint, a written funds-transfer verification procedure, a handbook and documented terminations, an entity schedule that matches your cap table, and renewal dates you track. A company with those practices pays less on every line and gets quoted by carriers that decline the rest.

We build the stack to the requirement in hand, place it across multiple carriers including E&S markets, and mark up the contract or term sheet so you know what it demands. If your incumbent program is priced right and structured right, we say so and leave it alone.

Send us your term sheet, your customer MSA insurance exhibit, or your current policy schedule, along with your stage, headcount, and headquarters state. Within 48 to 72 hours you will have what you need, what you can skip, and what it costs. Get a stage-appropriate quote.