Liability concerns

should I be worried?

[mrnastyone]

Hello everyone,

New member here... I'm just getting started in the web design and development business and I have a few concerns regarding liability. I apologize this is long but it needs to be clarified.

My work is hosted by a third party provider. I do not host any files locally on my PC that can be accessed via the internet.

Suppose I create a shopping cart for a client that generates on average $1000 a month in sales. Now suppose my third party host provider has a fire at their datacenter which causes the server on which this cart resides to be out of service for a week. Am I liable for the lost revenue that my client would normally expect to receive during that time?

Another example would be a customer contact database stored on the third party provider's server. Suppose that company does not update their router firmware in time and a hacker exploits a recent vulnerability and exposes or destroys that database. Would I be liable for these kinds of actions?

I am having touble finding an insurance company that is knowledgeable of these things. Perhaps a lawyer would be better suited?

Thanks for your feedback and I look forward to the community.

CB

[Lex_Luther]

Do you think your kinda puting alot of negatives worries before building your house? Cart before the horse? I think they are legitimate, but perhaps its best to build your house first and then if the roof leaks fix it.

[mrnastyone]

Lex_Luther, thanks for your reply.

Not to sound glib, but to use your analogy, no I'd rather be sure my architectural plans nor installation doesn't improve my chances of a leaky roof. Personally, I'd rather plan for the worst up front than deal with the fallout later.

I welcome any additional feedback.

CB

[PurpleMan]

I would take legal advise to ensure you cover yourself in any agreements, pointing out that the safe custody of data is the client's responsibility, as is the choice of host.

You could agree to recommend a host so long as the client understands that you are not responsible for that host's actions, and the hosting agreement is directly between them and the host.

[Easy_Coder]

On the insurance side you should be asking about an umbrella liability policy. That way they don't need to understand all of the specifics.

[mcjohnson]

Lex - sorry, the time to think about covering yourself for liability exposures is NOT after you have a loss.

That said, you can't have an Umbrella Liability Policy until you have a General Liability policy. A Standard GL policy will cover you for most appropriately drafted lawsuits, with a few exceptions; intentional torts, losses outside the policy period (or losses that predate the purchase of the policy, Lex)

You can purchase an Umbrella for extended coverage; Umbrella's are generally more broad, so a wider range of lawsuits is typically covered (i.e. some contracutal liability allegations, discrimination, and so on)

A standard GL policy should cover MOST of the allegations a client might make against you. Still, you need to be LIABLE before you'll be required to pay anything. There's a big gap between covered allegations, and a verdict.

For example, If a fire occurs in a facility in Denver, and your client's data is lost, what kind of negligence might they accuse you of? There needs to be a nexus between your alleged breach of duty, and the damages being suffered. If they suffer a loss of data because of a poorly installed electrical outlet by a contractor in a city over which you had no control, ever, I doubt seriously that a cause of action against you would stand up.

Keep in mind, that anyone can pretty much sue anyone for anything, but in general, you're going to be covered unless you have a specific exclusion for loss of data (which I have never seen on a GL policy), are accused of intentional torts, or so on. You'll likely have a defense, especially under your umbrella, and your insurance-carrier appointed attorney will get the complaint dismissed.

Look into a basic GL with an Umbrella endorsement. You should be fine.

Pat

[mrnastyone]

Thanks everyone for your contributions. This will make me better informed as I speak with a lawyer and my insurance agent.

I welcome additional input.

CB

[andye]

suppose my third party host provider has a fire at their datacenter which causes the server on which this cart resides to be out of service for a week. Am I liable for the lost revenue that my client would normally expect to receive during that time?

...third party provider's server. Suppose that company does not update their router firmware in time and a hacker exploits a recent vulnerability and exposes or destroys that database. Would I be liable for these kinds of actions?

There's no 'default' assumption for this type of thing, it all depends on the contract you have with the client.

To get round these issues where a third party causes you liability, you might prefer to have the client contract direct with the hosting company.

Otherwise - if you do want to be responsible for providing the hosting - you need to think about the contract terms. The sort of thing you're talking about above is indirect or consequential loss, you want to make sure you're not liable for that type of loss. Ideally you want your maximum liability to be no higher than the total amount the client has paid you.

You can buy contracts off the shelf that should deal with these sorts of issues.

hth, a.