Insurance for tech startups in Singapore: what to buy at each stage
The startup insurance checklist by stage
A 5-person company and a 150-person company face different claims. The policies arrive in a predictable order.
| Stage | Trigger | Policies that become necessary |
|---|---|---|
| Incorporation, pre-seed | First employee | Work injury compensation for staff in scope; public liability if there is an office |
| First paying customer | Signed master services agreement | Technology E&O, cyber liability |
| Seed to Series A | Term sheet, board seat for an investor | D&O, often with a stated limit in the shareholders' agreement |
| Enterprise sales | Security questionnaire, SOC 2 request | Cyber at the limit named in the contract; E&O limit raised |
| Growth, 50+ staff | Group hiring, overseas entities | Group medical, employee benefits, overseas liability |
| Debt or key investor | Facility letter | Key person insurance on founders |
Buying everything at incorporation wastes cash. Buying nothing until a customer asks means binding cover under time pressure. The broker's role is to map the next 12 months of contracts and bind each policy before it is demanded.
Work injury compensation at 5 staff
Work injury compensation insurance is compulsory for every employee doing manual work and every non-manual employee earning S$2,600 a month or less. Engineers and salespeople above that threshold are not in scope. An office assistant or intern under it is. A 5-person startup with one intern at S$1,500 a month must insure the intern.
The policy is cheap relative to the penalty for not having it. It is the first policy most startups buy, and the first one a Ministry of Manpower inspection checks. See is WICA compulsory for office staff for the threshold rules and what counts as manual work.
Public liability for the office covers a visitor injured on the premises. Landlords in Singapore commonly require it in the lease at S$1 million or more.
Tech E&O and cyber: the two policies customers ask for
Technology errors and omissions insurance pays when the product or service fails and the customer suffers financial loss. A failed deployment, a data processing error, a missed service level, a bug that costs the customer revenue. It is professional indemnity written for software and IT services.
Cyber liability insurance pays for the startup's own breach response and its liability to others for a data incident. Forensics, notification, legal advice, business interruption from an outage, extortion payments where lawful, and third-party claims.
Ransomware cases reported to the Cyber Security Agency rose to 165 in 2025 from 159 in 2024. SMEs were the most affected group, which the agency links to lower security maturity and limited resources. A startup holding customer data is an SME in that statistic.
The Personal Data Protection Act allows financial penalties up to S$1 million, or 10% of annual Singapore turnover for organisations with turnover above S$10 million. The PDPC's investigation costs and the notification exercise are insurable. Whether the penalty itself is insurable depends on the wording. See cyber insurance and a PDPA breach.
Enterprise customers write both covers into the master services agreement with a stated limit. S$1 million to S$5 million each is common in Singapore contracts. The broker reads the clause before quoting, because a limit below the contract figure is a breach on day 1.
D&O after fundraising
D&O insurance is not required by law in Singapore. Investors require it. A priced round brings an outside shareholder, a board seat and a shareholders' agreement. That agreement usually obliges the company to maintain D&O cover at a stated limit, often S$1 million to S$5 million, within 30 to 90 days of closing.
Section 172 of the Companies Act permits the company to buy insurance for its officers against liability to the company or to third parties. The policy covers the founders, the investor director and senior managers for wrongful acts in managing the company. Defence costs for a regulatory investigation, a shareholder dispute or an employment claim are the common uses.
Timing matters. A policy bound after a dispute has started will exclude it. The broker binds D&O at the term sheet, not after the first board meeting.
Does cyber insurance satisfy a SOC 2 or security clause?
No. A SOC 2 report is an auditor's opinion on controls. Cyber insurance is a financial backstop. Enterprise procurement asks for both, in separate clauses.
The 2 interact in one way. Cyber underwriters now ask the same control questions a SOC 2 audit covers: multi-factor authentication, offline backups, endpoint detection, privileged access management. A startup that has done the SOC 2 work gets better cyber terms and fewer exclusions. One without those controls may be declined or offered a ransomware sub-limit.
Insurance certificates, not policy wordings, are what procurement teams collect. The broker issues them with the limit, period and insured name matching the contract. A certificate naming the wrong entity, a common error after a restructure into a holding company, fails the procurement check.
Key person insurance and financing
Key person insurance pays the company a lump sum if a named founder or executive dies or is diagnosed with a critical illness. Lenders and some investors require it because the business depends on 2 or 3 people.
The Enterprise Financing Scheme defines a young enterprise as one formed within the past 5 years, with at least 1 employee and more than 50% of equity held by individuals. Those enterprises receive a 70% government risk-share on scheme loans, against 50% for others. Banks lending under the scheme still assess the borrower, and a facility letter can require key person cover on the founders for the loan amount.
The sum insured is set against the loan, the cost of recruiting a replacement and 6 to 12 months of lost revenue. The company owns the policy and receives the proceeds.
What moves the price
No premium is quoted here. Underwriters price a startup programme on:
- Revenue and its forecast, which set the rating base for E&O and cyber.
- Customer concentration and contract limits.
- Data held: records count, payment data, health data.
- Security controls, evidenced by a questionnaire or SOC 2 report.
- Funding raised, investor base and US exposure, for D&O.
- Headcount and salary bands, for work injury compensation.
A startup that documents its controls and reads its contracts before approaching the market gets quoted faster and at better terms than one that arrives with a customer deadline in 5 days. Underwriters also price growth. A company forecasting 3 times revenue is rated on the forecast, with an adjustment at year end.
Frequently asked questions
What insurance does a pre-seed startup actually need?
Work injury compensation for any employee doing manual work or earning S$2,600 a month or less. Public liability if the lease requires it. Nothing else is compulsory. Cyber and E&O become necessary when the first customer contract names them.
When do investors require D&O?
At the first priced round with an outside board member, usually as a covenant in the shareholders' agreement with a stated limit and a deadline after closing. The policy should be bound at the term sheet so that no dispute is already in progress at inception.
Does cyber insurance satisfy an enterprise customer's security clause?
Not on its own. Security clauses ask for controls and often a SOC 2 or ISO 27001 report. Insurance clauses ask for a policy at a stated limit. A startup needs both, and the controls improve the insurance terms.
Is WICA compulsory for a 5-person startup?
Yes, for any employee doing manual work and any non-manual employee earning S$2,600 a month or less, including interns and part-timers. Engineers and managers above the threshold are outside the compulsory scope and can be added voluntarily.
Sources
General information only, not advice on any particular policy. Cover depends on the policy wording and the insurer's terms.