After you buy a vertical software company, first check that its technology errors and omissions and cyber coverage fits what the software does for customers. Then check whether it reaches claims about the seller's past releases, and compare its limits with the liability caps and indemnities in your customer contracts. Also read the intellectual property exclusions and check how a customer data breach or a claim from an overseas customer would be handled. This checklist is for searchers, Small Business Administration (SBA) loan buyers and holding companies that just closed on a software business serving one industry.
The short answer
- Technology errors and omissions (E&O) insurance, often called tech E&O, covers customers' financial losses when your software fails. Cyber covers breaches and network events. Many carriers combine them, sometimes under one shared limit.
- Both are usually claims-made, so the retroactive date and any change in control clause decide whether the seller's past code and incidents stay covered. In an asset purchase, covering the seller's prior acts is the new carrier's underwriting decision.
- Customer contracts often cap your liability but carve out data breach and intellectual property claims. Those carve-outs are where uninsured exposure tends to sit.
- Many tech policies cover some copyright and trademark claims but exclude patent and trade secret claims. Read the wording.
- General liability has a limited coverage territory, and tech policies vary. Check where suits can be brought if you sell abroad.
Which policy pays when your software fails or customer data leaks?
They answer different questions. Technology errors and omissions (E&O) insurance, often called tech E&O, covers claims that your software or services cost a customer money. Think of a billing module that miscalculates, an update that takes a customer offline or a data migration that corrupts a customer's records. Cyber covers events on your own network and data: a breach of customer data you host, ransomware, notification costs, extortion and your own lost income from an outage, plus liability to people whose data was exposed.
For a vertical software company the two overlap, because the customer data you host is often the product. Carriers frequently sell a combined form. That is efficient, but read three things:
- Shared or separate limits. A single aggregate limit for tech E&O and cyber means one bad breach can use up the limit you were counting on for a software error claim later that year.
- Insuring agreements bought. Combined forms are modular. Check that first-party breach costs, business interruption, regulatory defense and media liability are actually on the declarations, not just in the form.
- Contingent business interruption. Most vertical software runs on a cloud provider. Ask whether an outage at your hosting provider counts, what sublimit and waiting period apply, and whether any widespread event or infrastructure exclusion could remove it.
General liability is still needed for visitor injuries at your office and for customer contracts that require it, but it does little here. See the professional liability review, the cyber review and professional liability vs cyber liability.
Does the coverage reach the seller's past releases and incidents?
That depends on the retroactive date (the earliest date of acts the policy covers) and on any change in control clause. Tech E&O and cyber policies are usually claims-made: they respond to claims first made during the policy period about acts or events after the retroactive date.
In a stock purchase the company's own policy may continue, and you can ask the carrier to keep the existing retroactive date, often called full prior acts. But many tech and cyber forms change after a change in control, for example by covering only acts and events that happened before the sale, so read the clause and notify the carrier as it requires. In an asset purchase into a new entity, a new policy may start its retroactive date at closing. Claims about bugs in the seller's code, or a breach that started before closing and is found later, may then fall outside it. Whether the new carrier will cover the predecessor's prior acts is an underwriting decision, often made after reviewing the seller's claims history. The seller's tail (extra time after its policy ends to report claims about past acts) usually protects the seller's entity, not automatically your new company. So the seller's indemnity in the purchase agreement, within its caps and time limits, may be your main recourse for the rest; ask deal counsel how far it reaches.
Before or at closing, the seller can usually give notice of known incidents and circumstances to its expiring policy. Ask deal counsel to make that part of the closing checklist. See prior acts and tail coverage.
Do your customer contracts promise more than your policy covers?
Often, and this is one of the most useful hours you can spend in the first month. Software contracts usually include a limitation of liability clause, which caps what you owe a customer, often at a multiple of fees paid. But the cap usually has carve-outs, and those are where large claims land.
| Contract term | Typical wording | Insurance question |
|---|---|---|
| Liability cap | Fees paid in the prior 12 months | Is your tech E&O limit at least as high as your largest realistic cap? |
| Data breach carve-out or super cap | Uncapped, or a higher separate cap for data incidents | Does your cyber liability limit reach that amount, and does it cover contractual notification costs? |
| Intellectual property indemnity | You defend the customer against infringement claims | Does your policy cover the type of claim, and does it cover liability you take on by contract? |
| Service levels | Uptime commitments with service credits | Service credits and fee refunds are commonly excluded |
| Insurance requirements | Minimum tech E&O and cyber limits, certificates | Do current limits meet the largest customer's terms? |
| Assignment and change of control | Customer consent or notice after a sale | A contract question for deal counsel, but it affects who the named insured must be |
Many policies exclude liability you assume under contract unless you would have been liable without the contract. That makes broad indemnities a coverage risk even when the limit looks big enough. Ask your broker to read your top 10 customer agreements against the policy, and see checking customer contracts against your policies.
A hypothetical example. A buyer acquires a scheduling platform for veterinary clinics with $8 million of annual recurring revenue. The largest customer, a clinic group, has a contract with an uncapped data breach indemnity. A misconfigured database exposes client records for its 40 clinics. Notification, credit monitoring and the clinic group's legal costs run to $1.4 million, and the combined policy carries a $1 million shared limit. Even if the carrier accepts the claim under the policy terms, at least $400,000 lands on the buyer's balance sheet in the first year, cash the buyer had planned for debt service and product hires. A higher cyber limit, or a negotiated super cap, might have changed the outcome. The numbers are illustrative.
Are you covered if someone says your software infringes their patent or copyright?
Partly, at best. Read the intellectual property exclusion in each policy rather than assuming:
- General liability. The standard Insurance Services Office (ISO) form covers only narrow advertising injury and excludes most copyright, patent, trademark and trade secret claims. It also has a separate exclusion for businesses that design website content for others or provide internet services. Expect little help here.
- Tech E&O and media coverage. Many tech policies cover some copyright and trademark claims tied to your software or content. Patent infringement and trade secret misappropriation are commonly excluded.
- Separate options. Standalone intellectual property defense policies exist, usually priced on your specific patents, markets and history.
Also ask what the seller did on open source licensing and code ownership. A representation in the purchase agreement may help, but it is a contract remedy, not insurance. See seller indemnity vs insurance.
What if you have customers outside the United States?
Check the coverage territory (the places where events and suits are covered) in every policy. The standard general liability form covers the United States, Puerto Rico and Canada. It reaches the rest of the world only for injury from products made or sold in those places, short business trips by residents and some online offenses. Even then, liability must be decided in a suit brought in one of those places or in a settlement the insurer agrees to. Tech E&O and cyber forms vary: some cover claims anywhere, others only suits brought in certain countries.
Overseas customers also bring their own privacy laws. The European Union's General Data Protection Regulation (GDPR) can apply to companies outside the European Union that offer services to people there or monitor them. Whether it applies to your company is a question for privacy counsel. Whether fines and penalties are insurable depends on the policy and on local law. If you have customers or staff in other countries, ask whether you need a foreign policy or locally issued coverage, and confirm currency and claims handling terms.
What belongs on my first-month checklist?
| Check | Why it matters in vertical software | Ask for |
|---|---|---|
| Tech E&O and cyber | Software failures and customer data breaches | Policy, declarations, limits structure, retroactive date, change in control clause |
| Top customer contracts | Caps, carve-outs and insurance requirements | Largest 10 agreements and the standard terms |
| Hosting and vendor contracts | Outage and breach costs often start with a vendor | Cloud and payment vendor terms |
| Payments handled in the product | Funds flows and fraud exposure | Crime policy, social engineering terms, payment controls |
| Directors and officers | Investor and board claims after a search fund or equity deal | Policy and change in control terms |
| Employment practices | Integration, layoffs and remote staff in several states | Employment practices liability policy, states covered |
| Overseas exposure | Territory and privacy laws | Customer list by country, foreign coverage |
A commercial umbrella usually does not sit over tech E&O or cyber, so higher limits there come from excess policies built for those lines. If the company has a board or outside investors, see directors and officers coverage for a search fund board. For neighbouring businesses, the managed IT services checklist covers liability when a client is breached through your tools. A Morrow review can read your contracts against the policies, flag gaps and request quotes where it makes sense.
Keep reading
- New Owner Review: Cyber Insurance
- New Owner Review: Professional Liability (Errors and Omissions)
- How to Check Your Customer Contracts Against Your Policies
- Prior Acts and Tail Coverage After an Acquisition: Who Pays?
- Just Bought a Managed IT Services Provider? Your Insurance Review Checklist
- All guides for new business owners
Frequently asked questions
Do I need both tech errors and omissions and cyber insurance for a software company?
Many software companies that host customer data carry both, often on one combined policy. Tech errors and omissions covers customers' losses from software failures; cyber covers breaches, ransomware and your own response costs. Check whether the limits are shared.
Does my insurance cover bugs in code the seller wrote before I bought the company?
Only if the policy reaches back far enough. These policies are usually claims-made, so coverage depends on the retroactive date and any change in control clause. In a stock purchase, ask the carrier to keep the existing retroactive date (full prior acts). In an asset purchase, the seller's tail usually protects the seller's company, not yours. Ask whether the new carrier will cover the predecessor's prior acts (an underwriting decision), and check the purchase agreement's indemnity.
Our contracts cap liability at 12 months of fees. Is that enough protection?
The cap helps, but many contracts carve out data breach and intellectual property claims, sometimes with no cap at all. Compare those carve-outs with your cyber and tech limits, and ask whether your policy covers liability you assumed by contract.
Will my insurance defend a patent infringement claim?
Often not. General liability excludes most infringement claims, and many tech errors and omissions policies exclude patent and trade secret claims while covering some copyright and trademark claims. Separate intellectual property policies exist.
Does the umbrella policy add limits over cyber?
Usually not. A commercial umbrella typically sits over general liability, auto and employers liability. Extra cyber or tech errors and omissions limits usually come from excess policies written for those lines.
References
- IRMI: Technology errors and omissions insurance (definition)
- IRMI: Limitation of liability clause (definition)
- ISO: Commercial General Liability Coverage Form CG 00 01 12 07 (carrier-hosted copy)
- IRMI: Retroactive date (definition)
- EUR-Lex: Regulation (EU) 2016/679 (General Data Protection Regulation)
Just bought a business? Get your insurance reviewed.
Send Morrow the declarations pages, loss runs and key contracts you inherited. Morrow can review them against the business you bought, flag gaps and request quotes where it makes sense. Any new terms depend on carrier underwriting.
Morrow · 25 New Chardon Street, 4th Floor, Boston, MA 02114
This article is general information, not legal, tax or financial advice, and not a coverage determination. Coverage depends on the actual policy wording, carrier underwriting, your purchase agreement and your contracts. Ask your attorney and accountant about deal and legal questions.