SaaS enterprise insurance requirements: what clients may ask for

Enterprise customers may ask a software as a service (SaaS) vendor to hold certain insurance before signing. Common requests include technology professional indemnity (Tech PI) insurance, cyber insurance and a certificate of currency (Tech PI explainer). These SaaS enterprise insurance requirements may sit in a vendor insurance schedule attached to the master services agreement (MSA).

Tech PI insurance is designed to cover claims that your advice, service or work caused a client financial loss. It may include legal defence costs, compensation and any settlement you are legally liable to pay, subject to the policy terms.

Cyber insurance is designed to cover costs after a data breach or cyber attack. First-party costs may include incident response, forensics, notifying affected people and data recovery. Third party cover may respond to claims from customers or regulators.

Each cover is subject to the policy terms, conditions and exclusions. Cover depends on the policy and insurer you choose. Check the policy wording and its terms and conditions for what is and isn't included.

Why do SaaS enterprise insurance requirements come up in procurement?

Procurement teams may set software vendor insurance requirements so a vendor holds insurance that may respond if its software or service leads to a claim. The same Tech PI explainer notes that many enterprise, government and corporate contracts ask technology providers to hold insurance at specified limits before work starts.

What do tech professional indemnity and cyber policies commonly exclude?

Each policy commonly excludes some losses, so holding every listed policy may still leave gaps.

Tech professional indemnity

Exclusions commonly include, but are not limited to:

• service credits, liquidated damages and other liability you take on under a contract that would not otherwise exist under the law (contractual liability exclusion)
• physical injury or property damage
• claims and circumstances you knew about before the policy started

Cyber insurance

Exclusions commonly include, but are not limited to:

• intellectual property claims, such as patent or trade secret disputes, although an exception may apply to some software copyright claims
• incidents a senior executive knew about, or could reasonably foresee, before cover started
• outages at third party utilities or telecoms providers, unless the provider's own security failure directly caused them

Important: These lists are not exhaustive. Exclusions vary between insurers. Always refer to the policy wording and its terms and conditions for the exclusions that apply to you, and if you have questions you should speak to your insurance broker or the upcover team.

What is a certificate of currency, and can a customer be named on your policy?

A certificate of currency is a document that "confirms that an insurance policy is active for a specific business or project". Customers may ask for one as proof that each listed policy is in place.

A customer may also ask to be named on the certificate as an interested party. upcover's glossary describes it as "A third party named on the certificate, such as a landlord or lender, where the insurer accepts this".

upcover's certificate of currency guide says "A certificate only confirms the policy was active on the day it was issued."

What if enterprise customer insurance requirements ask for more cover than you hold?

If a customer's schedule asks for a higher limit or an extra policy, you can ask whether the requirement is negotiable before you sign.

The specified limit is the most the insurer may pay, subject to the policy terms. It may apply per claim, in the aggregate (the most the insurer pays in total for the policy period) or both.

upcover's guide to choosing a level of cover explains what may happen if you sign while holding less cover than a contract asks for. Licensing, professional or contractual requirements may also influence the limit of insurance you consider, which may affect the cost. An upcover team member or an insurance broker can talk through the schedule with you.

What should you check in your SaaS vendor insurance before signing?

Before signing, you can compare the customer's schedule with your policy schedule (the document that sets out your cover details) on eight points:

• Policies: each policy listed, and whether your policy schedule describes the services in the MSA
• Limits: each specified limit, per claim or in the aggregate
• Entity: the legal entity signing the contract, against the insured entity on your policy
• Territory and jurisdiction: where the customer operates and which country's law applies
• Indemnities: what each indemnity clause asks you to pay for (breach of contract guide)
• Liability cap: the cap and anything carved out of it
• Service level agreement (SLA): the uptime promise and service credits (SLA guide)
• Evidence deadline: when the customer wants a certificate of currency

Where a product uses artificial intelligence (AI), our AI provider outage and AI agent guides explain the extra questions this raises for SaaS vendor insurance.

How upcover can help

upcover arranges Tech PI and cyber insurance for software and SaaS businesses. upcover works with 80+ insurance partners and can arrange quotes from a range of insurers.

• 70,000+ businesses covered across Australia
• 4.9/5 customer rating
• 80+ insurance partners

Get a quote for enterprise software and SaaS insurance.

Frequently asked questions

What insurance do SaaS companies need for enterprise clients?

SaaS enterprise insurance requirements depend on the customer and the contract. upcover's SaaS startup guide describes a procurement team sending "a vendor insurance schedule requiring Tech PI and cyber at specific limits, plus a Certificate of Currency".

What does a SaaS certificate of currency show?

A certificate of currency commonly shows the insured name, policy type, insurer, policy period and cover limit, according to upcover's certificate of currency guide. The Department of Defence guidance note says it "will not provide details of the full terms, conditions and exclusions of cover".

Do policies that meet SaaS enterprise insurance requirements cover every contract liability?

Some contract liabilities may still sit outside cover. Tech PI policies commonly include a contractual liability exclusion, which "removes cover for liabilities you accept only because of a contract".

Does your policy's limit of indemnity need to match the contract value?

A schedule's minimum limit may differ from the contract value. The limit of insurance you consider may also reflect factors such as the indemnities you agree to and the size and stage of your business. An upcover team member or an insurance broker can talk through these factors with you.

‍

_{Written by upcover's editorial team. This article provides general information only and does not take into account your objectives, financial situation or needs. It is not legal advice: get legal advice about your contract terms, including indemnities, liability caps and insurance clauses. Insurance availability and cover are subject to underwriting and the terms, conditions, limits and exclusions of the relevant policy. Read the policy wording and its terms and conditions before deciding. upcover arranges insurance products with selected insurers and underwriters and does not compare all general insurers or insurance products available in the market.}