Someone replied to a discussion about custom software with a list of insurance policies: cyber liability, privacy liability, data breach cover and something called tech E&O. Apparently, that adds up to an “easy 10k a year” for a small business with its own tech stack.
The comment made insurance sound like a fee that appears the moment a business chooses custom software. Before accepting that price tag, I'd like to know whether any of it is compulsory. And if the business uses GoHighLevel instead, where did its need for insurance go?
Is the insurance compulsory?
Not simply because the business commissioned an app. I work from Portugal and have clients in different countries. Portugal has compulsory insurance for some kinds of work, but I found no blanket rule saying a software developer must buy those policies just for building a custom app. The Portuguese government's guide to professional insurance lists the kinds of work for which insurance is required. The link is in Portuguese.
The GDPR requires businesses to protect personal information in ways that fit the risk. It does not tell everyone with customer records to buy cyber insurance. A client may still require a particular policy in its contract. A business working in another country or a regulated field may have other requirements. Those are things to check for the actual project.
There are also good reasons to buy insurance when nobody makes you. If a mistake in my work costs a client money, professional liability cover might help. If a business suffers a data breach, cyber cover might help with some of its costs. Insurance can be worth having. I just don't see how commissioning custom software obliges every business to buy the commenter's entire list.
Two businesses could even use the same software and have very different conversations with an insurer. One keeps names and phone numbers for appointment reminders. Another keeps detailed, private records about its clients and gives access to a much larger team. The second business has more to explain before anyone can suggest suitable cover. Telling me both businesses use GoHighLevel would not settle the question. Telling me both commissioned a custom app would not settle it either.
The commenter listed privacy liability and data breach cover separately. Both can fall within a cyber policy; the UK's National Cyber Security Centre recommends checking existing cover before buying more. For all we know, the client already has some of it.
What happens when the business uses GoHighLevel?
Let's keep the same business and the same customer records. Instead of commissioning a booking app, it puts its bookings in GoHighLevel. An employee can still download the customer list and send it to the wrong place. The business still decides which staff can see it and what to do if something goes wrong.
GoHighLevel maintains its platform, which can be a very good reason to use it. But the business has not handed over every decision about its customers. HighLevel's own terms of service say customers are responsible for their use of the platform, including “securing and maintaining proper insurance as required.” So even HighLevel does not present the subscription as an escape from whatever insurance the customer's business may need.
And what if I am the person setting up GoHighLevel for the client? I can still connect the wrong account or build an automation that sends information where it should not go. I do not stop providing a professional service because I am configuring someone else's software instead of writing every part of it myself.
“Custom” can also cover quite a range of setups. I might build the part that handles a client's particular workflow while using established services for the database, email and payments. The client does not have to operate every piece of technology from scratch. Equally, a business using GoHighLevel might connect it to other tools and hire someone to build automations around it. An insurer would need to know what those connections do and who looks after them. The product name alone will not explain any of that.
The risks are not identical. With a custom app, someone must maintain the code. The developer might also have access to live records for support. With GoHighLevel, the provider handles its platform, while the business and anyone it hires still have their own jobs to do. A client or an insurer may care about those differences. Fine. We can describe the two setups and ask what cover makes sense for each.
What I cannot do is put insurance on the custom side of the comparison and leave the GoHighLevel side blank. If the business needs cover for its customer data or its own mistakes, subscribing to a platform does not make that question disappear. And if no law or client contract requires a particular policy, building a custom app does not magically make it compulsory.
I'd settle those questions before putting a compulsory insurance bill in anyone's budget.