Tech Company Insurance California: SaaS, Startups & IT Firms

Most tech founders first think about insurance on the day a customer’s procurement team sends over a Master Services Agreement with a five-page insurance exhibit. Suddenly there is a deadline, a list of acronyms, and a signed deal waiting on a certificate you don’t have yet.

I’m Shalom Samya, a licensed commercial insurance broker based in Tarzana. I place tech company insurance California founders actually need: SaaS companies, dev shops, IT consultants, managed service providers and hardware startups across Los Angeles and the rest of the state.

This guide covers what each policy does, how coverage should change as you move from pre-seed to growth, what enterprise customers and investors expect, and where California law creates exposure that founders in other states don’t have to think about as much.

Why Tech Companies Need a Different Insurance Approach

A restaurant’s biggest risk is someone slipping on a wet floor. A tech company’s biggest risk is usually invisible: code that fails, data that leaks, a deadline that slips, or a promise in a contract that turns out to be expensive.

That is why a standard small business package often leaves tech companies badly underinsured. A general liability policy responds to bodily injury and property damage. It generally does not respond when your software outage costs a customer revenue, or when a hacker pulls records out of your database.

The coverage that matters most for tech lives in three places: professional liability (Tech E&O), cyber liability, and management liability (D&O and EPLI). General liability, workers’ comp and property still matter, but they are the foundation, not the whole building.

The Types of Tech Businesses I Work With

“Tech company” covers a lot of ground, and underwriters treat each type differently. Here is how I think about the main groups:

• SaaS and platform companies. You host data, you promise uptime, and your customers depend on you daily. Cyber and Tech E&O are the core of your program.
• Dev shops and agencies. You build software for clients under statements of work. Your biggest risk is a project dispute: missed deadlines, bugs, or a claim that what you delivered doesn’t match what was promised.
• IT consultants and managed service providers. You often have admin access to client networks. If an attacker gets into a client through your credentials, you may be looking at a very large claim.
• Hardware and IoT startups. You have everything a software company has, plus product liability, inventory, manufacturing partners overseas, and potentially product recall exposure.
• Marketplaces and fintech. Payments, user-generated content and regulated data bring in crime coverage, media liability and sometimes regulatory questions that need a specialist carrier.

If you’re an independent consultant rather than a product company, my guide to consulting business insurance in California covers that side in more detail.

Tech E&O Insurance: The Core Policy for Most Tech Companies

Tech E&O insurance (technology errors and omissions) is professional liability written specifically for companies that provide software, technology services or technology products. It covers claims that your product or service failed to perform and caused a customer a financial loss.

Typical claims look like this: a bug corrupts a customer’s data, an integration breaks and stops their billing for a week, a project is delivered late and the client says it cost them a product launch, or a customer argues your software didn’t do what the sales deck said it would.

Tech E&O pays for your legal defense and for settlements or judgments, subject to the policy terms. Defense costs alone in a commercial software dispute can be significant even when you did nothing wrong.

Claims-Made Coverage and Why the Retro Date Matters

Almost every Tech E&O policy is written on a claims-made basis. That means the policy in force when the claim is made is the one that responds, as long as the work happened after your retroactive date.

Your retro date is one of the most valuable things you own in insurance. If you switch carriers, make sure the new policy honors your existing retro date instead of resetting it to today. A reset means past work is suddenly uninsured.

If you sell the company or shut it down, ask about an extended reporting period (often called tail coverage). Acquirers frequently require it as part of the deal.

What Tech E&O Usually Doesn’t Cover

• Contractual penalties and service credits you agreed to pay regardless of fault.
• Refunds of your own fees (many policies exclude or limit this).
• Patent infringement, which is usually excluded or offered only in narrow form.
• Bodily injury and property damage, which belong on general liability.
• Intentional or fraudulent acts.

Read your contracts alongside your policy. The mistake I see most often is a company agreeing to uncapped liability in an MSA while carrying a $1 million E&O limit. The insurance doesn’t expand to match what you signed.

You can read more on the general line on my professional liability insurance page.

Cyber Insurance for Tech Companies

Cyber insurance for tech companies is not optional anymore. If you store customer data, process payments, or have access to client systems, a single incident can create costs that outrun a young company’s bank account.

Many carriers now package Tech E&O and cyber together on one form. For most tech companies I prefer a combined policy, because it avoids the gap where one carrier says “that’s a cyber claim” and the other says “that’s an E&O claim.”

Cyber coverage splits into two halves, and you need to understand both.

First-Party Cyber Coverage (Your Own Losses)

First-party coverage pays for costs your company incurs directly after an incident:

• Breach response: forensic investigators, breach counsel, and public relations.
• Notification costs: letters, call centers and credit monitoring for affected individuals.
• Business interruption: lost income when your systems or your cloud provider go down because of a covered event (check whether dependent or contingent business interruption is included).
• Cyber extortion and ransomware: negotiation, and payments where legally permitted and approved by the carrier.
• Data restoration: rebuilding data and systems.
• Funds transfer fraud and social engineering: often sublimited, sometimes excluded, and sometimes better placed on a crime policy.

Third-Party Cyber Coverage (Claims Against You)

Third-party coverage responds when someone else comes after you because of a security or privacy failure:

• Network security and privacy liability: customers or individuals suing because their data was exposed or because malware spread from your systems to theirs.
• Regulatory defense and penalties: costs of responding to regulators, and fines or penalties where insurable by law.
• PCI-DSS assessments: fines and assessments from card brands if you handle payment card data.
• Media liability: claims of defamation, copyright or trademark infringement in your content (not patents).

For a tech company, third-party exposure is usually the bigger number. Your customers’ data is what attackers want, and your customers will look to you when it walks out the door.

What Underwriters Ask About Now

Cyber applications have gotten much more detailed. Expect questions about multi-factor authentication on email and remote access, endpoint detection and response, offline or immutable backups, patching cadence, and employee phishing training.

Weak answers can mean higher premium, a ransomware sublimit, or a decline. Missing MFA on remote access is one of the fastest ways to get declined. If you’re preparing for SOC 2, a lot of that work carries straight into a stronger cyber application.

More detail on policy structure is on my cyber liability insurance page.

CCPA, CPRA and California Breach Notification Rules

California has some of the strictest privacy laws in the country, and they directly affect how much a data incident can cost. I’m a broker, not a privacy lawyer, so treat this as a general overview and get legal advice on your specific obligations.

The CCPA and CPRA in Brief

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to for-profit businesses that do business in California and meet at least one threshold. Those thresholds involve annual gross revenue (originally $25 million and now adjusted for inflation), buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning half or more of revenue from selling or sharing personal information.

Enforcement sits with the California Privacy Protection Agency and the Attorney General. Many early-stage startups fall below the thresholds, but B2B SaaS companies often end up contractually bound to CCPA terms as a “service provider” through their customers’ data processing agreements anyway.

The Private Right of Action for Data Breaches

The piece that matters most for insurance is the CCPA’s private right of action for data breaches. When certain nonencrypted and nonredacted personal information is exposed because a business failed to maintain reasonable security, consumers can sue for statutory damages of $100 to $750 per consumer per incident, or actual damages if greater.

Multiply that range by thousands of records and you can see why class action lawyers watch California breaches closely. This is exactly the exposure third-party cyber coverage is designed to defend.

California’s Breach Notification Law

California Civil Code §1798.82 requires businesses to notify California residents when their unencrypted personal information is, or is reasonably believed to have been, acquired by an unauthorized person. The notice has content and format requirements, and the timing rules have been tightened in recent years, so confirm current deadlines with breach counsel.

If a single breach requires notifying more than 500 California residents, a sample copy of the notice must also be submitted to the California Attorney General. If you have customers in other states, each state has its own notification law, which is one reason first-party notification costs add up quickly.

A good cyber policy gives you access to a pre-approved breach counsel panel. Call them first, before you notify anyone, so the response is handled correctly from the start.

D&O Insurance for Startups

D&O insurance for startups (directors and officers liability) protects the people running the company, and usually the company itself, against claims alleging mismanagement, breach of fiduciary duty, or misrepresentation.

Founders often assume D&O is only for public companies. In practice, private company D&O claims come from investors, co-founders, acquirers, competitors, vendors and regulators. A dispute over a down round, a failed acquisition, or a founder departure can all trigger one.

When You Need D&O

The honest answer: once you take outside money or add independent board members. Institutional investors commonly make D&O a condition of the round or of taking a board seat, and experienced independent directors often won’t join a board without it.

Bootstrapped companies with no outside board can sometimes wait. But once you’re negotiating a priced round, get D&O quotes going early so it doesn’t hold up the closing.

Side A, Side B and Side C

• Side A covers individual directors and officers when the company can’t or won’t indemnify them, for example in insolvency.
• Side B reimburses the company when it does indemnify its directors and officers.
• Side C (entity coverage) covers claims made against the company itself. For private companies this is usually broader than on public company policies.

Many private company carriers package D&O with EPLI, fiduciary liability and crime into one management liability policy. For a small team that can be the most efficient way to buy it, as long as the limits are adequate and not all shared in a way that leaves you thin.

EPLI and California Employment Law

If I had to name the single most underestimated risk for California startups, it’s employment claims. California is one of the most employee-friendly jurisdictions in the country, and tech companies scale headcount fast, often without a dedicated HR team.

Employment practices liability insurance (EPLI) covers claims of wrongful termination, discrimination, harassment, retaliation and related allegations from employees and job applicants.

California Rules That Drive EPLI Risk

• FEHA: most of the Fair Employment and Housing Act’s protections apply once you have 5 or more employees, but harassment protections apply to employers with even 1 employee.
• Harassment prevention training: employers with 5 or more employees must provide sexual harassment prevention training to supervisors and non-supervisory employees.
• Contractor classification: California’s ABC test (from AB 5) makes it harder to treat developers and designers as independent contractors. Misclassification can cascade into wage, tax and workers’ comp problems.
• Wage and hour claims: EPLI typically excludes wage and hour liability, or offers only a small defense sublimit. That exposure has to be managed through proper payroll and classification practices.

Layoffs and reorganizations are when EPLI claims spike. If you’re planning a reduction in force, make sure your EPLI is in place well beforehand, because a claim arising from a known situation may not be covered by a new policy.

For more on how these policies are structured, see my page on employment practices liability insurance.

Workers’ Comp for Tech Companies (Including Remote Teams)

Under California Labor Code §3700, virtually every employer with even one employee must carry workers’ compensation. Operating without it is a crime, and the Labor Commissioner can issue stop orders and penalties. Being a software company with low physical risk doesn’t change that.

The good news is that clerical and software development class codes are among the lowest-rated in the state. California workers’ comp is priced per $100 of payroll by class code, based on advisory pure premium rates published by the WCIRB, with each carrier filing its own rates on top.

The Remote Employee Problem

This is where I see tech companies get the setup wrong most often. A California policy covers your California employees. If you hire an engineer who lives in Texas, Colorado or New York, you need coverage that satisfies that state’s requirements.

That’s usually handled by listing the state on the policy or through other-states coverage, but there are exceptions. North Dakota, Ohio, Washington and Wyoming are monopolistic states, where workers’ comp must be purchased from the state fund, so a private carrier’s policy won’t satisfy the requirement for employees based there.

Every time you hire in a new state, tell your broker. Payroll by state also affects your premium and your audit. If you use a PEO or employer of record, confirm in writing whose policy covers which employees.

If you have 1099 contractors who would fail California’s ABC test, an auditor may reclassify their pay as payroll at audit time, and you’ll get a bill for the additional premium.

My full guide to workers’ compensation in California covers class codes, audits and experience mods in more depth.

General Liability and Property for Offices and Hardware

General Liability

General liability covers bodily injury, property damage, and personal and advertising injury to third parties. For a pure software company it’s relatively inexpensive, but it is almost always required by office leases, coworking agreements and customer MSAs.

For hardware and IoT companies, GL becomes much more important. The products-completed operations portion is what responds if your device overheats, starts a fire, or injures someone. Underwriters will want to know about your manufacturing partners, testing, certifications and where you sell.

Property, Equipment and Inventory

• Business personal property: laptops, servers, furniture and office build-outs. Your landlord’s policy doesn’t cover your stuff.
• Equipment off-premises: with remote teams, company laptops live in employees’ homes. Make sure your policy covers equipment away from the office.
• Inventory and transit: hardware startups need coverage for stock in warehouses, at third-party logistics providers, and in transit, including ocean shipments from overseas manufacturers.
• Earthquake: excluded from standard property policies. For companies with significant equipment or inventory in Los Angeles, it’s worth at least pricing a separate earthquake policy.

Product Recall and International Exposure

Product recall is a separate coverage. GL generally does not pay the cost of pulling a defective product off shelves. If you sell physical devices at scale, price it.

If you have employees, contractors or customers abroad, a foreign liability package can cover gaps that domestic policies leave, including employee travel and local liability claims.

For a broader look at how GL fits into a small business program, see my commercial insurance California guide.

Not sure your current policies line up with your customer contracts? I’ll review your coverage and your MSA insurance requirements side by side at no cost. Call me at (323) 999-6067 or request a free coverage review.

Startup Insurance California: Coverage by Company Stage

Startup insurance California companies buy should grow with the business. Buying a growth-stage program at pre-seed wastes cash. Staying on a pre-seed program at Series B leaves the company exposed. Here’s a general framework I use; every company is different, and your contracts may push you to buy coverage earlier.

These limits are starting points for discussion, not rules. Your customers’ MSAs, the sensitivity of the data you hold, and your investors’ expectations will usually be the real drivers.

What Enterprise Customer MSAs Typically Require

For a lot of tech companies, the insurance program is really designed by their largest customer. Enterprise procurement and legal teams use fairly standard insurance exhibits, and once you’ve seen a few, they start to look alike.

Here are the requirements I see most often in software and IT services agreements. Every contract is different, so always check the exact wording.

How to Negotiate the Insurance Exhibit

Insurance requirements are negotiable more often than founders think. Procurement teams usually start with a template written for their largest vendors. If you’re a 12-person SaaS company, asking to reduce a $10 million E&O requirement to $2 million or $3 million is a normal conversation.

Send me the exhibit before you sign. I can tell you which items your current program already meets, which need an endorsement, and which will cost real money, so you can negotiate with actual numbers in hand.

Also look at the indemnification and limitation of liability clauses. An insurance exhibit that matches your policy is only half the picture. If you agree to indemnify the customer for things your policy excludes, that’s an uninsured promise.

Security Questionnaires and Insurance

Enterprise customers usually send a security questionnaire alongside the MSA. Keep your answers consistent with what you told your cyber carrier. If the two don’t match, it can complicate a claim later.

What Investors Expect to See

Investors don’t usually dig into your GL policy. What they care about is that the company, and their board designees, are protected from the risks that can sink a young company.

In my experience, investors and their counsel commonly look for:

• D&O in place at or before closing, with limits appropriate to the round and the board structure.
• Cyber and Tech E&O if the company handles customer data, since a breach can threaten the whole investment.
• Workers’ comp compliance in every state where the company has employees, because gaps show up in diligence.
• EPLI once headcount is growing, especially in California.
• Key person coverage is sometimes requested for critical founders, though it’s less common in venture deals than it once was.

During an acquisition, the buyer’s diligence team will review every policy, claim and retro date. Clean, continuous coverage with properly maintained retro dates makes that process much smoother.

Other Coverages Tech Companies Should Consider

Umbrella and Excess Liability

An umbrella sits on top of your GL, auto and employer’s liability and adds extra limits. Many enterprise MSAs require one. Note that a standard umbrella usually does not sit over Tech E&O or cyber; those need their own excess layers. See my umbrella insurance page for how the layers stack.

Crime and Social Engineering

Fake invoice and payment redirection scams target finance teams at fast-growing companies constantly. A commercial crime policy with social engineering coverage, or a strong funds transfer fraud section in your cyber policy, fills that gap.

Hired and Non-Owned Auto

Most tech companies don’t own vehicles, but employees drive their own cars to client meetings and on errands. Hired and non-owned auto covers the company’s liability when that happens, and it’s inexpensive to add.

Group Health

Not a liability policy, but in the competition for engineering talent in Los Angeles, benefits matter. Many startups add group health around the seed or Series A stage.

How I Approach Tech Insurance

My goal is to build a program that lets you sign contracts confidently and survive the incidents that do happen. That starts with understanding the business: what you sell, where your data lives, who your customers are, and where you’re headed in the next 12 to 18 months.

I work with multiple carriers and shop the market, which matters in tech because appetite varies a lot. Some carriers love SaaS but won’t touch fintech. Some write hardware well; others avoid it entirely.

I also think the service side matters as much as the price. When a customer needs a certificate with specific endorsements by end of day, or when you’ve just discovered a breach at 11 p.m., you need a broker who picks up.

Common Mistakes I See Tech Companies Make

• Buying a generic “business owner’s policy” and assuming it covers software failures or data breaches.
• Signing MSAs with uncapped liability or indemnities broader than their insurance.
• Hiring remote employees in new states without updating workers’ comp.
• Letting the E&O retro date reset when switching carriers.
• Skipping D&O until the week before a round closes.
• Treating 1099 developers as contractors without checking California’s ABC test.
• Answering cyber applications optimistically, then not actually having MFA or backups in place.

Getting Quotes: What to Have Ready

Having this information together makes the process faster and gets you better terms:

1. A description of your product or services, and who your customers are.
2. Current and projected revenue, and headcount and payroll by state.
3. Types and approximate volume of data you store or process (personal information, payment data, health data).
4. Your security controls: MFA, EDR, backups, SOC 2 or other certifications.
5. Sample customer contracts or insurance exhibits you need to satisfy.
6. Funding history, board composition and cap table basics for D&O.
7. Prior claims or incidents, and current policies with their retro dates.

Pricing depends heavily on revenue, data sensitivity, security controls, claims history, contract requirements and carrier appetite, so I don’t quote numbers without seeing the details.

Frequently Asked Questions

Does general liability cover a software failure?

Generally no. GL covers bodily injury and property damage. Financial losses caused by software bugs, outages or project failures fall under Tech E&O insurance.

Is Tech E&O the same as cyber insurance?

No, but they’re closely related and often sold together. Tech E&O covers claims that your product or service failed. Cyber covers data breaches, security incidents and your own response costs. Buying them on one combined form helps avoid gaps between the two.

When does a startup need D&O insurance?

Usually once you raise outside capital or add independent directors. Investors commonly require it at or before closing, so start quoting early in the fundraising process.

Do I need workers’ comp if all my employees are remote?

Yes. Each employee needs to be covered under the rules of the state where they work. California employers must carry workers’ comp for California employees, and out-of-state employees need coverage that satisfies their state, including the state fund in monopolistic states.

What is SaaS insurance?

SaaS insurance isn’t a single policy. It usually means a combined Tech E&O and cyber policy, plus GL, workers’ comp, and management liability (D&O and EPLI) as the company grows.

Does cyber insurance cover CCPA fines?

Many cyber policies cover regulatory defense costs and, where insurable by law, fines and penalties. Coverage for the CCPA’s statutory damages in private lawsuits typically falls under the privacy liability section. Wording varies by carrier, so check your specific policy.

What limits do enterprise customers usually require?

Common requirements are $1M/$2M GL, $1M to $5M Tech E&O and cyber, $1M employer’s liability, and an umbrella. Large enterprises sometimes ask for more, and these requirements are often negotiable for smaller vendors.

Can I add a customer as an additional insured on my E&O policy?

Additional insured status is standard on GL but uncommon on E&O and cyber, which are designed to cover your own professional liability. If a contract asks for it on E&O, it’s worth discussing with the customer and your broker.

Whether you’re a two-founder SaaS company closing your first enterprise deal or a hardware startup scaling production, I can help you build coverage that matches your contracts, your investors and your stage. For a free coverage review, call me at (323) 999-6067 or reach out here. I’ll look at what you have, what your contracts require, and where the gaps are.