Startup insurance: the 5 policies to take out (and in what order) after incorporation

Startup insurance is built from five policies, in a precise order: professional liability from the first client, multi-risk property cover from the first office, employee health and protection cover from the first hire, directors' and officers' liability at the fundraising stage, then cyber as soon as you host client data. Only employee social protection is legally compulsory, but every one of them ends up being required by someone: a key account, a landlord, an investor or a bank. The budget runs from €1,500 a year at pre-seed to €15,000 or more after a Series A.

Which startup insurance is actually compulsory at incorporation?

For a French SAS that publishes software or sells a non-regulated service, the law imposes no liability insurance. The obligations concern employees. From the first hire, you must offer a collective health plan funded at least 50% by the employer, with a minimum benefits basket, under the law of 14 June 2013 (articles L911-7 and D911-1 of the Social Security Code, in force since 1 January 2016). From the first "cadre" (executive-grade employee), the national collective agreement of 14 March 1947, carried over by the national inter-professional agreement of 17 November 2017, requires a protection contribution of 1.50% of salary up to the social security ceiling (€4,005 per month in 2026), paid entirely by the employer and allocated primarily to death cover. An employer who forgets it and loses a cadre owes the heirs three times the annual ceiling, i.e. €144,180 in 2026.

The rest depends on who is across the table. The landlord requires tenant's liability insurance (article 1733 of the Civil Code: the tenant is presumed liable for fire). The key account requires a professional liability certificate. The investor requires D&O cover, and often key person insurance, before wiring the funds.

In what order should a startup take out its five policies?

The order follows the events of the company's life, not a catalogue. Budgets below are those observed among French brokers and comparison sites in 2026 (there is no official statistic by stage).

Professional liability can be bound in a few days; D&O or cyber need a questionnaire and two to three weeks, hence the value of anticipating.

Why does professional liability come first?

It is the first document your clients ask for. Professional liability insurance compensates damage caused to your clients or third parties by an error in your service or product: a bug that corrupts a client's data, an outage that costs them a day of sales. General liability, often in the same policy, covers everyday incidents (an injured visitor, damage to the neighbour's premises).

For a tech startup, three points change everything. Pure financial loss ("dommages immatériels non consécutifs"), meaning financial losses suffered by the client without prior physical damage, the typical software scenario, must be explicitly covered, and not with a token sub-limit. The limit should be at least equal to revenue, and in practice aligned with what your contracts require: €1M to €2M per claim for a French key account, more in the United States. Finally, the declared activity must match what you actually do; an undeclared pivot is the first reason for a declined claim.

What do investors really require before a funding round?

Two things, rarely negotiable once the term sheet is signed. First, D&O insurance, known in France as RC dirigeants or RCMS (responsabilité civile des mandataires sociaux), which protects the personal assets of founders and board members, including the fund's representatives on the board, against claims for mismanagement, breach of legal duties or insolvency proceedings. Limits of €500,000 to €2M are common for small and medium companies; funds generally require €1M to €2M from Series A onwards, more if the company is hiring fast or expanding internationally.

Second, key person insurance on the founders, which pays a lump sum to the company if an indispensable executive dies or becomes disabled. Shareholders' agreements increasingly include a key man clause, and some funds make the release of funds conditional on the policy being in place. Due diligence also covers what already exists: certificates, declared activity consistent with the pitch, limits consistent with signed client contracts; our guide to the insurance audit before fundraising lists the points checked.

An investor does not ask you for D&O cover because they doubt you, but because they are about to sit on your board and put their own liability next to yours.

When should a startup take out cyber insurance?

As soon as it hosts or processes data for its clients, which for a SaaS means from the first contract. Cyber insurance covers three blocks: your own costs after an incident (investigation, restoration, CNIL notification, crisis management), your business interruption during the outage, and your liability towards third parties whose data leaked or whose service was interrupted. For a SaaS, ransomware stops your platform, and therefore every client's.

Insurers make cover conditional on technical prerequisites: multi-factor authentication on remote access and admin accounts, tested offline backups, endpoint detection (EDR). A technical team that implements them from the start pays less; regulated clients (banks under DORA, NIS2 entities) also pass these requirements down into their subcontracting agreements.

What do key accounts and banks require?

Key accounts ask for a professional liability certificate with a stated limit and named covers (pure financial loss, data breach), and increasingly a cyber certificate. A mismatch between the certificate (activities, limits, deductibles) and the client contract's clauses (SLA penalties, liquidated damages) is common and is fixed upstream.

Banks, for a loan, look first at protection cover and key person insurance on the executive, and may require the benefit to be assigned to them.

How much does startup insurance cost by stage?

At pre-seed (two founders, a first client, a coworking desk), three policies are enough (professional liability, light multi-risk, health plan) for €1,500 to €3,000 a year. At seed, with five to ten employees and the first key accounts, cyber and an entry-level D&O bring the budget to between €4,000 and €8,000. After a Series A (twenty to fifty employees, professional liability and cyber limits raised to €2M, D&O at €2M, key person cover on the founders), the budget sits between €10,000 and €20,000 a year, generally under 0.5% of revenue. Fintech, healthtech and deeptech cost more than B2B SaaS.

Frequently asked questions

Does a startup with no employees need insurance?

No insurance is legally compulsory for a non-regulated SAS with no employees. In practice, the first client contract or the first lease triggers the requirement. Professional liability from day one costs €200 to €300 a year and avoids holding up a signature.

Is D&O useful if I am the sole shareholder?

Less urgent, but not useless: an executive's personal liability can be pursued by the social security agency, the tax authority, an employee or a liquidator. The real trigger is investors joining the board, who almost always require it.

Can all of a startup's insurance be bundled into one policy?

Partly. Professional liability, general liability and multi-risk are often combined in one policy. D&O, cyber, employee protection and key person cover remain separate policies, sometimes with different insurers.

What professional liability limit is needed to sign with a key account?

Most French key accounts require €1M to €2M per claim, with explicit cover for pure financial loss. Read the contract's insurance clause before responding to the tender.

At Lesto, we support tech startups and scale-ups from their first professional liability policy to the post-Series A programme: we read your client contracts and shareholders' agreement, build the five policies in the right order and consult nine insurers on average. Raising a round or signing your first key account? Discover our offer for SaaS and tech companies and request an analysis within 72 hours.