At a glance
Understand the risk.
Ask the right questions.
Online Business Insurance starts with a clear picture of the work you perform, the responsibilities you accept and the events that could interrupt your business. This guide brings together common risks, insurance categories, practical documents and questions to discuss with your broker. Your business may need a different combination of covers or extensions from another business in the same industry.
Use the sections below to prepare for an insurance conversation in Perth, Sydney, Melbourne, Brisbane, Canberra or elsewhere in Australia. These examples are general information, not a recommendation that a particular policy is suitable for you. Your activities, locations, contracts and the applicable policy wording need to be considered together.
General information only. This does not take into account your objectives, financial situation or needs. Before acting, consider whether the information is appropriate for you. Cover is subject to insurer acceptance and the policy terms, conditions, limits and exclusions. Read the Financial Services Guide and the relevant PDS (where applicable) and/or policy wording before deciding.
01 / Understand your exposure
Common risks to consider.
- A payment, platform or fulfilment incident prevents orders from being processed.
- Customer information is exposed or fraud occurs through a compromised account or social-engineering event.
- A product, delivery or advertising dispute escalates into a liability or consumer complaint.
- An incident arising from the day-to-day activities of online businesses leads to an allegation of injury, damage or financial loss.
- A contract, approval or record does not clearly document the responsibilities of online businesses after a problem occurs.
- Software defects, configuration errors, failed integrations or service outages that affect a client’s operations.
02 / Connect risks with cover
Insurance commonly considered.
No single package suits every business. The descriptions below identify possible cover categories; each is subject to its own wording and underwriting.
may respond to covered allegations that professional services, advice, designs or omissions caused financial loss, subject to the insured services, retroactive date and claims-made notification requirements.
may assist with specified cyber incidents, privacy events, response costs and business interruption, depending on the event, security controls, sub-limits and exclusions.
may respond to certain third-party injury or property-damage allegations arising from business activities, subject to the insured activities and policy wording.
may cover specified buildings, contents, stock and equipment following insured events, subject to declared values, exclusions and settlement terms.
may assist with insured loss of gross profit or revenue and certain additional costs when a covered event triggers the policy, subject to the indemnity period and calculation basis.
may respond to certain directors and officers, employment-practices, statutory-liability or crime exposures where included, subject to policy terms and legal insurability.
A policy name does not establish that an activity or incident is insured. Review the insured business description, trigger, conditions, limits, excess and exclusions with your broker.
03 / A closer look at your business
Details worth discussing.
Describe the complete route from order to delivery
An online business is not defined only by its website. Explain what is sold, who supplies it, where stock is held and who fulfils each order. A digital subscription, a handmade product and an imported consumer item can create different exposures. Identify whether the business owns stock, uses a third-party warehouse or relies on suppliers to ship directly to customers. Include marketplaces and social channels as well as the main store. The insurer needs to understand the business model behind the checkout, particularly where the seller remains the customer’s main contact after another company has handled delivery.
Map the systems that allow customers to find products, pay and receive updates. Hosting, shopping cart software, payment services, email and inventory systems may be supplied by several providers. Describe the data held by the business and the access granted to staff or contractors. A platform outage, stolen account and fraudulent payment instruction are different events, even if each stops orders being processed. Ask how cyber, crime and interruption provisions apply to those scenarios. A payment provider’s security features or service agreement should not be treated as confirmation that the business has insurance for every related loss.
Compare customer promises with supplier responsibilities
Website terms, product descriptions and returns processes shape customer expectations. Keep a record of what was advertised, including relevant versions when a product or offer changes. If the business makes claims about performance, compatibility or suitability, understand the source of those claims and the role of the supplier. Products liability may be relevant to injury or damage allegations, while refunds, warranty work and replacement of defective goods can receive different treatment. Explain imports, private labelling and any alterations made before sale. Those activities may affect the risk description even if the products arrive fully manufactured.
Review fulfilment and marketplace agreements for stock ownership, loss responsibility and limits on the provider’s liability. Ask what happens if goods are damaged in storage, sent to the wrong person or unavailable after a supplier failure. Transit and stock cover should be discussed with the actual locations and handover points in mind. A business that holds little inventory may still face substantial customer commitments at a busy time. Keep purchasing records, maximum stock values and key service terms available. Distinguish the value of goods from expected profit and additional costs when considering how an interruption could affect the operation.
Plan for an unavailable store or compromised account
Identify who can contact the hosting, platform and payment providers if normal account access is lost. Keep recovery information through appropriate secure arrangements and review access when staff or contractors leave. Preserve useful logs and customer communications after an incident rather than immediately deleting evidence during cleanup. Record when order processing stopped, which functions were affected and what temporary steps were taken. Check the policy’s incident response and notification provisions before assuming that outside technical or legal costs will be reimbursed. Appropriate immediate steps to protect customers and systems should be coordinated with the relevant response arrangements.
Before renewal, review new product lines, territories, turnover peaks and changes in fulfilment. Consider whether sales through an overseas marketplace create activities not described in the current submission. Test practical recovery options for product data and orders, including whether backups can actually be restored. Keep a record of disputed transactions, customer complaints and significant supplier changes. Online operations can grow without acquiring larger premises, so physical size is a poor guide to changing exposure. The insurance discussion should follow the value of orders, the nature of products and the dependencies that keep the customer journey working.
04 / Put it in context
What an incident might look like.
Hypothetical examples only. These are not BAU client stories or predictions of a claim outcome.
A payment, platform or fulfilment incident prevents orders from being processed. The affected party seeks compensation, defence costs or rectification expenses. Whether any policy responds would depend on the allegations, insured activities, policy trigger, exclusions, excess and limit.
Customer information is exposed or fraud occurs through a compromised account or social-engineering event. The event also interrupts normal trading or creates additional expense. Property, liability, professional, cyber or interruption cover may be relevant only where the facts satisfy the applicable wording.
A few minutes. A different perspective.
Put your thinking
into practice.
Three situations for online business businesses. Choose a practical next step, then explore why the details matter.
A learning activity with hypothetical situations. It is not a risk assessment, personal advice or a prediction of insurance cover.
What would you do next?
Work through the facts, the records and the questions you would take to your broker. There is no time limit.
05 / Prepare for the conversation
Bring the details.
Make the discussion useful.
Documents and contracts
- Website terms, privacy policy and payment-platform agreements.
- Supplier, fulfilment, marketplace and delivery contracts.
- Master services agreements, statements of work, software licences and acceptable-use terms.
- Service-level agreements, hosting terms, data-processing agreements and privacy policies.
- Subcontractor, cloud-provider, payment-provider and reseller agreements.
- Security policies, incident-response plans, backup records and change-control procedures.
Questions to ask before choosing cover
- Are all products and services—development, hosting, support, data processing, consulting and managed services—listed?
- What uptime commitments, warranties, indemnities and liability caps appear in customer contracts?
- Does cyber cover include incident response, privacy liability, business interruption and social-engineering losses?
- How are open-source software, subcontractors, cloud providers and offshore development teams treated?
- Do the policy territory and jurisdiction match where customers, users and data are located?
06 / Know the limitations
What may not be covered.
The following are examples only, not a complete exclusion list. Product terms vary, and the applicable PDS and/or policy wording must be checked.
- Guaranteed performance, liquidated damages, service credits or contractual penalties unless specifically accepted.
- Known vulnerabilities, incidents or circumstances that pre-date cover or were not disclosed when required.
- Patent infringement and some intellectual-property disputes, which may require specialist cover.
- Failure to maintain minimum security controls, backups, patching or multi-factor authentication where policy conditions apply.
- Loss caused solely by supplier failure where dependent-business-interruption or contingent cover is absent.
07 / Questions, explained
Frequently asked questions.
What insurance do online businesses commonly consider?
Depending on their activities, assets, staff and contracts, online businesses may consider Professional indemnity insurance, Cyber insurance, Public and products liability insurance. Other policies or extensions may also be relevant. No single list is suitable for every business, and availability is subject to insurer appetite and underwriting.
Would insurance automatically respond if a payment, platform or fulfilment incident prevents orders from being processed?
Not automatically. A claim outcome depends on the actual facts, the policy period, insured activities, definitions, exclusions, conditions, excesses, sub-limits and notification requirements. The relevant wording should be reviewed before relying on cover.
What information is usually needed to obtain a quote for Online Business Insurance?
Insurers commonly request turnover or revenue, payroll, staff and contractor numbers, locations, claims or complaints history, and the exact activities to be insured, plus services provided, contract limits, data volumes, security controls, hosting arrangements and overseas customers. Complete and accurate disclosure helps the insurer assess the risk, but it does not guarantee that cover will be offered or that a future claim will be accepted.
08 / Keep exploring
Connect the wider picture.
Read about the primary insurance categories and clarify the terms used in policy discussions. A link does not mean a product is suitable for your business.
Useful insurance terms
Official guidance
Local understanding. National reach.
Across Australia.
Connected to your business.
Based in Osborne Park, Western Australia, and supporting businesses nationally. These are service areas, not separate BAU offices. State and territory requirements can differ.
WAWestern Australia+
Perth, Bunbury, Mandurah, Rockingham and Kalgoorlie.
NSWNew South Wales+
Sydney, Newcastle, Central Coast, Wollongong and Maitland.
VICVictoria+
Melbourne, Geelong, Ballarat, Bendigo and Shepparton.
QLDQueensland+
Brisbane, Gold Coast, Sunshine Coast, Townsville and Cairns.
SASouth Australia+
Adelaide, Mount Gambier, Whyalla, Gawler and Port Pirie.
TASTasmania+
Hobart, Launceston, Devonport, Burnie and Ulverstone.
ACTAustralian Capital Territory+
Canberra, Gungahlin, Tuggeranong, Belconnen and Woden Valley.
NTNorthern Territory+
Darwin, Palmerston, Alice Springs, Katherine and Nhulunbuy.
Let’s start with your business
A clearer conversation
about your insurance.
Tell us what you do, what has changed and what you need to understand.
Speak with BAU Risk
Request a callback.
Tell us about your business and the cover questions you would like to discuss.
Before sharing personal information, read our privacy information.