Insurance For A Solo SaaS, Researched In One Claude Session

Freebo has been live in production for a few months. Real bookings, real payouts, real customer data in the database, real Stripe Connect money movement. The one thing I’d been quietly avoiding was insurance, because every time I searched “startup insurance” I got a landing page trying to sell me a $15,000 “seed stack” with D&O in it.

I finally sat down last Tuesday and did the whole thing in one Claude Code session. Not “chose a policy” — the actual research: read the Stripe Connect agreements, cross-referenced Texas non-subscriber law, priced eight carriers, understood what a retroactive date is and why it’s the most valuable line on the quote form, and produced a spec I could hand to Vouch on Monday morning.

Here’s what the answer actually looks like for a solo SaaS founder, and how I got there.

The whole thing collapses to three lines

Every “what insurance does my startup need” article I’ve read gives you eight categories and expects you to pattern-match. That’s noise. For a bootstrapped SaaS with payments and PII, three lines cover the entire risk surface and the rest is optional or wrong.

That’s it. The bundle is genuinely cheaper than either half standalone — Insureon’s median for the combined Tech E&O + Cyber policy is $1,516/yr versus $1,556/yr for cyber alone. GL is a rounding error you buy anyway, because Tech E&O explicitly excludes bodily injury and someone’s charter customer eventually falls off a boat and names every entity in the chain including the booking platform.

The four things I would have overpaid for a month ago:

• D&O. $6,300/yr median. It exists to protect directors from shareholder suits. I have no shareholders. Investor-driven purchase, not risk-driven.
• EPLI. $4,300/yr. Employees I don’t have suing me for things I can’t do to them.
• Workers’ comp. Texas is the only state with no mandate, and I have zero W-2 employees. $536/yr for a policy I have no legal obligation to buy.
• BOP. Bundles GL with commercial property. I have no commercial property. The bundle costs $870/yr to solve a $0 problem.

The single most valuable term on the quote form

The retroactive date. I did not know this a week ago.

Tech E&O and cyber are almost always written on a claims-made basis, not occurrence. That means the policy responds only if the claim is filed while the policy is active — but only for incidents that happened after the retroactive date. If you accept the default (policy inception), every bug currently sitting in your production code is permanently uninsured, forever, even if the claim arrives tomorrow.

Freebo has been in production since spring. If I bind a policy with today’s retro date, every bug I’ve shipped since then is exiled from coverage. The fix is one sentence in the application:

A carrier that won’t backdate is a reason to shop, not a reason to accept. This is a $0 negotiation that determines whether a $2,500/yr policy is actually worth $2,500.

What insurance does not fix

The most useful thing the research produced wasn’t a policy recommendation. It was a clear boundary around what insurance can’t touch.

Stripe’s Connect platform agreement is unambiguous: the platform (that’s me) is “liable to Stripe for the full amount of all Disputes… Refunds and Reversals regardless of the reason, timing.” Translation: if a connected account goes into the red, Stripe auto-debits my bank to cover it. I have seen this clause operate. No cyber, E&O, or crime policy responds to it — it’s a contractual obligation I agreed to, not a fortuitous loss. Insurance doesn’t cover things you promised to pay.

The controls for that specific risk are contractual and operational: a cash reserve, refund timing versus payout timing, and an operator agreement that pushes chargebacks back to the operator with a right of setoff against future payouts. Free. Higher leverage than any policy I could buy.

Same story with sublimits. “$1M cyber policy” routinely caps ransomware at $250K and funds-transfer fraud “as low as $100,000 or $250,000.” One worked example: $610K of actual loss recovered only $460K because three sublimits bit at once. For a payments-adjacent SaaS the funds-transfer-fraud sublimit matters more than the aggregate limit, because the realistic loss shape is “attacker uses compromised credentials to initiate fraudulent transactions” — exactly the scenario that falls into the gap between cyber and FTF coverage depending on trigger wording.

The one clause that is worth more than the E&O policy

The single highest-leverage thing on this whole page isn’t insurance. It’s a limitation-of-liability clause in the operator agreement that caps damages at fees paid in the trailing 12 months.

Market standard for SaaS. Extraordinarily powerful for a booking platform. An operator’s total recoverable damages become roughly their annual platform fees — a few hundred dollars, not the $5,200 charter they claim they lost when the calendar double-booked. Combined with a conspicuous disclaimer of consequential and indirect damages (ALL CAPS, because courts require conspicuousness), the “I lost a whole season because your calendar broke” theory just dies at the summary judgment stage.

Underwriters price this in. Companies with documented controls and a real contractual liability cap pay materially less than identical peers without them. So the ToS afternoon literally lowers your premium.

The four questions in writing

Every underwriter gets these before I bind:

1. What retroactive date will you grant? Ideally backdated to the first production booking.
2. Any financial-services, money-movement, or payment-processing exclusions on the form? Show me the language.
3. What are the funds-transfer-fraud and social-engineering sublimits, and can I negotiate them up to $250K–$500K?
4. Will you add named additional insureds on the cyber policy? Some budget digital carriers add AI on GL but not cyber. If an operator contract demands it and my carrier won’t issue, I’m re-shopping under time pressure.

Every one of these is a $0 question that changes what the policy actually covers. Underwriters don’t volunteer any of them.

What I’m actually doing this week

Three quotes in parallel: Vouch (startup-native, Hiscox paper behind it, has an explicit fintech vertical), Corgi (fastest same-day binding for this class, use as a price check), and one Insureon application that shops several carriers off one form. Expected landing zone $2,400–$2,900/yr for Tech E&O + Cyber at $1M/$1M plus GL at $1M/$2M.

Before I open any of those forms:

• Confirm MFA is enforced on every admin account across your whole stack — hosting, database, payments, source control, email. One root account without MFA fails an entire questionnaire, and any control you attest to has to be true at the time of loss, not just on the day you filled out the form.
• Report platform-fee revenue, not gross booking volume through Connect. This is the single number that most often gets a marketplace SaaS founder quoted like a company 20x their size.
• Write the operations description once, reuse it. “Cloud-hosted booking software… payments processed by Stripe Connect; Freebo is the platform and operators are connected accounts… no raw cardholder data stored (Stripe-hosted payment elements).” That last sentence about card data does real work on the cyber rate.

Bind Wednesday. Pay annually — monthly billing carries installment fees that add $100–$200 on a $2,500 premium. Calendar T-45 days before renewal because claims-made policies that lapse turn everything you’ve ever built retroactively uninsured.

The meta-lesson

The reason I’d been avoiding this for months is that insurance is a domain where every source is trying to sell you something and the underlying rules are boring but consequential. Exactly the shape of problem an LLM with tool use is built for: read the primary sources (Stripe’s actual agreements, Texas Department of Insurance forms, carrier pricing pages), triangulate across biased ones (every broker’s blog), and produce a concrete recommendation with the tradeoffs visible.

The output isn’t “buy this policy.” The output is a spec I can hand to three underwriters on Monday and know when they’re stalling on the questions that matter.

The whole session took about two hours. The premium delta between “researched” and “bought whatever Vouch’s quote engine spat out first” is probably $500 a year. The delta between “researched” and “bought the $15K seed stack the first article recommended” is $12,500 a year.

That’s a good hourly rate for reading Stripe’s terms of service.