FCA authorised · FRN 7249520117 325 0027Quote & buy →
Chasing an enterprise contract that specifies a PI or cyber limit? We'll read the clause with you and make sure your cover actually satisfies it before you sign.
Get a tailored quote →Reviewed by Apex Insurance Brokers · Last reviewed 2026-08-06
Software-as-a-service companies sit in an unusual spot. You rarely touch a physical product, so the traditional broker instinct to lead with property or public liability misses the point. Your real exposures are digital and contractual: the code you ship, the uptime you promise, and the sensitive data you hold on behalf of paying customers. When something goes wrong, the loss is usually financial and it usually lands on someone else's balance sheet before it lands on yours.
Think about what a typical B2B SaaS business is actually on the hook for. A bad deployment corrupts a customer's records. An outage during their peak trading window costs them revenue. A misconfigured integration exposes personal data. A feature you sold doesn't perform as the contract described. None of these involve a slip, a trip, or a fire — but every one of them can trigger a claim, a contractual penalty, or a regulator's attention. The covers that matter for SaaS are the ones built around professional performance and data, and they need to scale in step with your customer base and your funding.
For a SaaS business, professional indemnity (PI) — often written as technology errors & omissions, or a combined tech PI policy — is the single most important cover you'll buy. It responds when a client alleges that your software, service or advice failed them and caused a financial loss. That includes negligent code, a service level breach, a missed deliverable, or a defect that disrupts the client's own operations. IT consultancies that would rather not run the process in-house can read about our specialist PI broking for IT consultants.
A good tech PI policy for a software company typically brings together several strands under one roof:
The reason PI matters so early is commercial, not just defensive. The moment you start selling to mid-market and enterprise customers, their procurement and legal teams will ask for evidence of cover before they'll sign. It's routine for an enterprise contract to specify a minimum PI limit — figures such as £1m, £5m or £10m appear as illustrative examples of the sort of limits large customers ask for, and the right number for you depends entirely on the size of the deals in your pipeline and what your contracts require. Being under-insured relative to a customer's demand doesn't just create risk; it can stall the deal outright.
Larger or more complex risk? Speak directly to a director — call 0117 325 0027 or email info@apexinsurancebrokers.co.uk.
Every SaaS company is, in effect, a data business. You store, process and move information that belongs to your customers — and often to their customers in turn. That makes cyber insurance a genuine core cover rather than a nice-to-have. Where PI answers for the quality of your service, cyber responds to the consequences of a security incident: a breach, ransomware, a business email compromise, or an outage caused by an attack.
A well-structured cyber policy usually covers both first-party and third-party costs. First-party covers your own response — forensic investigation, restoring systems and data, business interruption while you're down, and the specialist support you need in the first frantic 48 hours. Third-party covers your liability to others: claims from affected customers, and the costs of managing your obligations if personal data is compromised, including notification and regulatory engagement. Under UK GDPR and the Data Protection Act 2018, a personal data breach can carry reporting duties to the Information Commissioner's Office, and cyber policies typically fund the expert help you'll want at that moment.
There's an important overlap to understand. Some tech PI policies include a slice of cyber; some cyber policies edge into technology liability. Left unmanaged, that overlap creates gaps and disputes about which insurer responds. Getting a broker to map PI and cyber together — so the two wordings dovetail rather than collide — is one of the more valuable things you can do before a claim ever arises. Our guide to cyber insurance for startups goes deeper on what a strong policy looks like.
Directors' & officers' (D&O) insurance protects the personal liability of your founders, directors and senior team for decisions they make running the company. It's worth being precise here: D&O is not a legal requirement. What changes is that once you take institutional money, it is very commonly required by investors — the obligation to put D&O in place is frequently written into the term sheet or subscription agreement, typically from Series A onwards.
The logic is straightforward. As soon as you have professional investors and a board, the people making decisions carry personal exposure — to claims from investors, regulators, employees or creditors alleging mismanagement, misrepresentation or breach of duty. D&O ring-fences directors' personal assets and makes the board seat a less daunting place to sit, which is exactly why VCs insist on it before they'll join your board. Term sheet clauses vary in how they word the requirement, so it's worth having your specific wording reviewed rather than assuming a standard policy ticks the box. Our explainer on directors' and officers' insurance unpacks how the cover works in practice.
For a software company, your IP is a huge part of what makes you fundable — and it cuts both ways in insurance terms. On one side, there's the risk that you infringe someone else's IP: a patent, copyright or trademark claim brought against you, which can be enormously expensive to defend even when you're ultimately in the right. Many combined tech PI policies include an element of IP infringement cover for exactly this reason, though limits and exclusions differ, so check what yours actually provides.
On the other side is the cost of enforcing your own rights if a competitor copies you. That's a different and more specialist product — IP pursuit or enforcement cover — and it's not something every SaaS company needs, particularly early on. The practical takeaway is to know which risk you're worried about and buy deliberately, rather than assuming a standard policy handles both. It rarely does.
As soon as you employ staff — and most SaaS companies do well before Series A — employers' liability insurance becomes a legal requirement under the Employers' Liability (Compulsory Insurance) Act 1969, subject to a few narrow exceptions. It covers claims from employees who are injured or become ill because of their work. In a software business the physical risks are modest, but the obligation is real and the penalties for not holding valid cover can be significant, so it's not something to overlook while you focus on the more exciting policies.
Beyond that, plenty of SaaS companies also carry public liability (useful the moment you have an office, host events, or visit client sites) and, if you offer contractual benefits, elements like private medical or group life as you grow the team. These aren't the headline covers, but they round out a sensible programme.
The most useful way to think about SaaS insurance is as a programme that grows with your cap table. You don't need everything on day one — you need the right cover for the stage you're at and the customers you're selling to.
None of this is rigid — a company selling six-figure contracts to banks at seed will need heavier cover than a Series B business selling £20-a-month subscriptions. The stage framing is a starting point; your actual pipeline and contracts decide the detail. If you'd like the full picture across a round, our startup insurance guide maps how these covers fit together.
Founders always want a number, and we understand why — but the honest answer is that premiums for SaaS cover depend on factors specific to your business, not a fixed rate card. The main drivers are your annual revenue, the type of customers you serve (selling into regulated industries or handling sensitive data pushes risk up), the volume and sensitivity of the data you process, the limits your contracts require you to carry, your claims history, and the security controls you have in place. On cyber especially, insurers increasingly reward genuine hygiene — multi-factor authentication, backups, access controls — with better terms. The best way to reduce cost is rarely to cut cover; it's to present your business well and buy the right limits rather than the biggest ones.
Raising, hiring, or landing your first enterprise logo? We hand-hold SaaS founders through each stage so your cover keeps pace with your funding — and your term sheet.
Get a tailored quote →The covers above interlock in ways that are easy to get wrong on a comparison site — PI and cyber overlapping, a D&O clause in a term sheet that a generic policy doesn't satisfy, an enterprise contract quietly demanding a limit you don't hold. A broker who works with venture-backed software companies reads the contract with you, structures the programme so the wordings fit together, and makes sure the cover you buy is the cover a customer or investor will accept. If you'd like to talk it through before your next round or your next big contract, speak to an Apex specialist — we do this for founders every week.
Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority (FRN 724952). This article is general information, not advice on a specific policy or a recommendation to buy any product.
