A food brand carrying a million dollars of liability cover, six policies, and a recall already on its record had no recall coverage at all. Every limit on that program was adequate.
Insurance conversations for ecommerce brands usually revolve around limits and price, which are the two easiest things to compare and among the least predictive of whether you are covered.
The claims that hurt small brands tend not to exceed a limit. They fall into the space between policies, where each insurer can point at another policy that was supposed to handle it.
This is written for ecommerce operators and is not insurance advice. Coverage terms, exclusions and requirements vary by carrier, state and product category, and only your actual policy wording determines what you are covered for. The purpose here is to help you ask sharper questions of a broker, who is the person qualified to answer them.
What The Standard Stack Is
Establishing the baseline, so the gaps are visible against it.
| Coverage | Answers | Typically Bought As |
|---|---|---|
| General liability | Claims that your business activities or products caused bodily injury or property damage. Product liability is generally included. | Standalone or inside a bundled policy |
| Commercial property | Damage to your stock, equipment and premises from fire, theft and similar events. | Usually inside a bundled policy |
| Business interruption | Lost income while a covered event stops you operating. | Commonly included in a bundled policy |
| Cyber liability | Breach response, notification, regulatory exposure, ransomware. | Separate policy or endorsement |
| Workers compensation | Employee injury. Requirements are set by state law. | Separate, where you have employees |
Business owner's policy. A packaged insurance product combining general liability, commercial property and usually business interruption coverage into a single policy, generally priced below the equivalent standalone policies purchased separately, with one source reporting savings of roughly 15 to 20 percent. It is designed as a foundation for small businesses with premises and physical assets, and it is not a comprehensive program: cyber incidents, product recall logistics and goods in transit typically sit outside it and require separate arrangement.
The bundled policy is the right foundation for most brands holding inventory, and the phrase to hold onto is that it is a foundation rather than a program. Everything in sections three through six sits outside it.
Product liability, which is included within general liability, has its own set of complications around marketplace requirements, certificate wording and policy form. Those are covered separately in our product liability guide and are not repeated here.
Limits Are Not Coverage
The case that makes this article's argument better than any list of policy types.
One review describes a specialty food retailer at roughly $27 million in revenue, running a six-policy insurance program costing around $127,000 a year, carrying general liability limits of $1 million per occurrence and $2 million aggregate. Solid limits, professionally arranged, and not cheap.
That brand had no product recall coverage at all, despite a Listeria recall already appearing on its record.
For a food brand, recall is a when-not-if exposure, and the logistics cost lands entirely outside the general liability limit. Check what the policy actually answers, not just how high the limit reads.
What makes the example instructive is that nothing about it looks like negligence. Six policies, adequate limits, real premium spend, a broker involved. The program answered the wrong questions competently.
The source also makes a point worth carrying into your own review: the real cost of risk on an account like that runs several times the premium, because the uninsured exposures do not disappear by being unpriced.
Which suggests a different review method than comparing quotes. Start from the claims your specific business is likely to face, then check which policy answers each one. Where nothing answers, you have found either an acceptable retained risk or a gap, and the point is to know which.
Gap One: Recall Logistics
The first and most category-dependent of the four.
General liability responds to harm caused by a defective product. It does not fund the operation of getting that product back, which is a substantial and separate cost: notifying customers and retailers, reverse logistics, destruction or rework, replacement stock, and the internal effort of running the exercise.
Those costs arrive whether or not anyone was actually injured. A precautionary recall with zero injury claims produces no general liability claim at all and a large bill.
Ingestible products, anything for children, cosmetics and personal care, and products with electrical or battery components. In these categories a recall is a foreseeable operating event rather than a catastrophe, and treating it as unthinkable is how a brand ends up in the position described in section two.
The practical questions for your broker are whether recall expense coverage is available for your category, what it includes, and whether it extends to a recall you initiate voluntarily rather than one mandated by a regulator. That last distinction matters, because the responsible action is usually to move before you are told to.
If coverage is unavailable or uneconomic for your category, that is a legitimate outcome. The failure is not knowing, discovering it during a recall, and having no reserve set against an exposure you had implicitly accepted.
Gap Two: Cyber
The gap that applies to every online seller without exception, including those holding no inventory at all.
Reporting is consistent that neither general liability nor a standard bundled policy covers cyber incidents. Data breaches, ransomware, and the regulatory and notification obligations that follow require a separate policy or endorsement.
The misconception worth correcting concerns payment processors. Processors cover unauthorised transactions on their own network, which is real and useful and is not breach coverage. Reporting notes they do not cover the forensic investigation, regulatory notification requirements, legal defense, or customer data remediation that fall on you as the party controlling the data.
The trigger is lower than most sellers assume. If you hold customer email and shipping addresses, you hold personal data and you carry notification obligations if it is exposed. A brand that never touches card details still has this exposure.
The Federal Trade Commission publishes cybersecurity guidance for small businesses and a data breach response guide. Reading the response guide before buying a policy is the fastest way to understand what a breach actually requires of you, which is the thing the policy is meant to fund.
Standalone cyber cover is reported at roughly $25 to $100 monthly for a million dollars of coverage, which for most brands is the least expensive gap to close relative to the exposure it addresses.
Gap Three: Goods In Transit
A gap that follows directly from how ecommerce works and is routinely assumed away.
Commercial property covers stock at an insured location. Goods moving between locations are frequently outside that, whether crossing an ocean in a container or moving from a port to your warehouse.
The assumption that catches brands is that the carrier covers it. Carrier liability is generally limited by contract and by convention, often to an amount per unit of weight bearing no relationship to what your goods are worth. A pallet of high-value small items is the worst case for this arithmetic.
Cargo cover addresses the difference, and the questions to ask are what perils are included, whether the cover runs door to door or only for the sea leg, and how the value is calculated, since a policy paying your cost price does not restore your position if the stock was already sold forward.
The exposure scales with concentration rather than with revenue. A brand receiving one large container quarterly has more at stake in any single shipment than one receiving weekly deliveries, because a single loss removes a quarter of the year's supply.
That is also why this gap is worth pricing rather than assuming. The relevant number is not the annual value shipped but the value of your largest single consignment, since that is the loss you would actually be absorbing.
Gap Four: Inventory At A 3PL
The most specific to this audience and the most commonly missed, because almost every ecommerce brand has stock in a building it does not control.
Reporting is direct: merchants using third-party fulfillment centers should verify their own policy covers off-site inventory, because the center's policy covers its own facility operations rather than your goods.
The reasoning is straightforward once stated and rarely stated. Your fulfillment provider insures its buildings, its equipment and its liability. Your inventory is your asset sitting in their building, and their policy is not written to indemnify you for it.
Fulfillment agreements commonly limit the provider's liability for loss or damage to your goods, sometimes severely. That limitation, combined with a property policy covering only your own premises, can leave the majority of your inventory value effectively uninsured while sitting in a warehouse you visit twice a year.
The same applies to marketplace fulfillment programs and to any arrangement where stock is held on your behalf. The question is not whether the building is insured but whether your goods within it are, and by whose policy.
Two questions close this gap. Ask your insurer whether your property cover extends to inventory at named third-party locations and at what limit. Ask your fulfillment provider what their liability is for loss or damage to your goods and what evidences it. Do both, because the answers frequently do not meet in the middle.
Home-based sellers have a related and simpler version of this problem: reporting is clear that standard homeowner's coverage does not cover business stock, so inventory in a spare room needs a commercial policy.
The Ecom Profit Box
Our collection of ecommerce growth resources, including the margin frameworks risk decisions need.
Get It FreeStock Sitting At A 3PL?
Their policy covers their building, not your goods. We can help you work out what your exposure actually is.
Book A CallWhy Category Beats Revenue
The pricing insight that reframes what a quote is telling you.
One source puts it plainly: a clothing brand and a supplements brand can both do $500,000 in revenue, and the supplements brand will pay roughly ten times more for the same coverage limits. What you sell drives cost far more than how much you sell.
The logic is obvious once stated. Underwriters price the probability and severity of a claim, and an ingestible product carries a fundamentally different loss profile from a t-shirt regardless of turnover.
- Higher-rated: ingestibles and supplements, products for infants and children, cosmetics and topicals, electrical and battery-powered items, anything mounted, climbed on or used at height.
- Lower-rated: apparel, most homewares, accessories, print and paper goods.
Three practical consequences follow. Quotes are not comparable across brands, so a peer's premium tells you nothing. A category expansion is an insurance event and should be raised with your broker before launch rather than at renewal. And in high-rated categories, the premium is signalling something real about your exposure rather than being an insurer's caution.
That last point is worth sitting with. If your category prices at ten times a clothing brand, the underwriter is telling you that claims in your category actually happen. Treating that as an unfair cost rather than as information is a mistake.
Whatever the number, judge it against contribution rather than revenue, since insurance is a fixed operating cost against margin. Our contribution margin playbook covers building that view.
What It Costs, Honestly
Published figures for this vary so widely that reporting the spread is more honest than reporting an average.
The spread is explicable rather than mysterious. Sources describe different businesses: different categories, inventory values, employee counts, vehicle use and limits. Given section seven, a range this wide is what you would expect when category drives pricing and the sources are not describing the same category.
It also means published averages cannot budget for you. Every figure here comes from insurance brokers and comparison sites that earn on placement, and the only number that describes your business is a quote for your business.
What the figures do establish usefully is relative cost. Bundling is reported to save roughly 15 to 20 percent against buying the components separately, and standalone cyber cover is consistently reported as inexpensive relative to what it addresses.
The practical approach is to get several quotes with identical stated limits and exposures, since only then are you comparing anything at all, and to ask each broker what the policy does not answer rather than only what it does.
The Statistic Being Misused
Worth flagging because it appears in nearly every article aimed at small sellers and is close to meaningless for them.
You will repeatedly encounter the claim that the average data breach costs $4.4 million. That figure is an all-company average dominated by large enterprises with vast record counts, regulatory exposure and legal expenditure that bear no relationship to an ecommerce brand with a few thousand customers.
Citing it to a small seller is scaremongering rather than information. It also fails at its own purpose: a number that implausible invites dismissal of the entire risk, which is worse than not mentioning it.
Reported alternatives are far more useful. One source puts small business breach costs above $200,000 per incident. Another estimates remediation for a store with around 5,000 customer records at $60,000 to $120,000. Those numbers are still serious, and unlike the enterprise average they describe a business you might recognize.
The same reading applies throughout insurance marketing. When a figure seems designed to alarm rather than to inform, check what population it describes, because averages taken across wildly different company sizes are not describing anyone in particular.
The honest version of the cyber argument does not need the big number anyway. You hold customer data, notification obligations attach if it is exposed, neither general liability nor a bundled policy responds, and the cover is inexpensive. That is sufficient without invoking a figure from a different universe.
Marketplace Requirements
Briefly, since these set a floor rather than a target, and the floor is not the same across platforms.
Reporting indicates Amazon requires $1 million per occurrence in commercial general liability once a seller reaches $10,000 in monthly gross proceeds, with the platform named as additional insured, and gives a short window to comply. Walmart is reported to require $1 million per occurrence and $2 million aggregate once sellers reach $100,000 in twelve-month gross merchandise value.
Two observations for brands selling across several platforms. The thresholds differ, so you can be compliant on one and not another while your business looks identical from the inside. And the additional insured wording is platform-specific, so a certificate accepted by one may be rejected by another for reasons that have nothing to do with your limits.
The more important point is conceptual. A platform requirement describes what the platform wants in place to manage its own exposure. It is a floor set by someone else's risk assessment, and it has no relationship to what your business would need in a serious claim.
A brand insured exactly to the marketplace minimum has satisfied a listing requirement rather than made a risk decision, and the four gaps in this article all sit entirely outside anything a marketplace asks about.
Structures By Business Model
How the stack changes with how you actually operate.
Holding your own inventory. A bundled policy is the foundation, since you have property to insure. Add cyber. Verify off-site inventory cover if any stock sits elsewhere, and consider cargo if you import in meaningful consignments.
Fulfillment handled by a third party. The property component matters less for premises and more for goods, so section six is your priority question. Reported guidance is explicit that a fulfillment center's policy covers its operations rather than your inventory.
Dropshipping. No inventory does not mean no product exposure. Reporting notes dropshippers remain exposed to product liability as the seller of record, and cyber applies regardless of fulfillment method because you still collect customer data.
Home-based with stock on site. A commercial policy is required, since homeowner's coverage does not extend to business inventory.
Selling digital products only. Product liability exposure is limited, cyber is not, and cyber becomes the primary rather than the secondary policy.
Reporting makes this point directly and it is worth repeating: a manufacturer's liability policy covers its own operations, not yours. Supplier agreements are worth reviewing carefully, because a supplier's insurance is not a substitute for your own and being named on someone else's certificate is not the same as holding cover.
Questions For Your Broker
Eight questions that surface the gaps in this article in a single conversation.
- Does my property cover extend to inventory at third-party locations, and at what limit? The most commonly missed exposure for this audience.
- Is recall expense covered, and does it extend to a voluntary recall? Not merely a regulator-mandated one.
- What happens to goods in transit, and how is their value calculated? Cost price cover may not restore your position.
- Is cyber included, endorsed or absent? And what does it fund: forensics, notification, legal defense, remediation.
- What does this policy specifically exclude for my category? Ask for the exclusions, not the summary.
- What claim in my business would this program not answer? A good broker will tell you, and the answer is the point of the meeting.
- Does business interruption respond to supplier failure or platform suspension? Reporting notes this depends on specific policy language rather than being assumed.
- What changes if I add a new product category? Ask before launching, not at renewal.
Question six is the one worth insisting on. Brokers are practised at explaining what a policy covers and less often asked what it does not, and the food brand in section two would have found its gap in that conversation.
The Version To Carry
A bundled policy is the right foundation and is not a program. Four exposures sit outside it and all four are specific to selling online: recall logistics, cyber, goods in transit, and inventory in someone else's building. The last is the one almost every ecommerce brand has and almost nobody has checked.
Judge cover by what it answers rather than by the size of the limit, price it against your category rather than against a peer's premium, and remember that a marketplace requirement is a listing condition rather than a risk decision.
What To Remember
- A high limit tells you how much a policy pays, not whether it answers your claim. One reviewed food brand carried six policies and adequate limits with no recall coverage at all.
- Your inventory at a third-party fulfillment center is not covered by their policy, which insures their facility operations rather than your goods. Verify your own property cover extends to off-site stock.
- Neither general liability nor a bundled policy covers cyber incidents, and payment processors cover unauthorised transactions rather than forensics, notification, legal defense or remediation.
- Recall logistics sit outside general liability entirely, and those costs arrive even where nobody was injured and no liability claim exists.
- Category drives premium far more than revenue, with a reported example putting a supplements brand at roughly ten times a clothing brand at identical revenue and limits.
- The $4.4 million average breach figure is an all-company average dominated by large enterprises. Figures nearer $60,000 to $200,000 describe businesses at this scale.
- Marketplace minimums are listing conditions, not risk decisions, set by someone else's exposure assessment, and all four gaps sit outside what any marketplace asks about.
Where This Came From
- Federal Trade Commission cybersecurity guidance for small businesses and data breach response guide for business.
- Insurance broker and comparison site reporting on the composition of a business owner's policy, reported savings of roughly 15 to 20 percent against separately purchased components, and the exclusion of cyber incidents from both general liability and standard bundled policies.
- Insurance industry review describing a specialty food retailer at approximately $27 million revenue with a six-policy program costing around $127,000 annually, carrying $1 million per occurrence and $2 million aggregate general liability limits while holding no product recall coverage despite a prior Listeria recall, together with the observation that recall logistics costs fall entirely outside general liability limits.
- Ecommerce insurance reporting that third-party fulfillment centers insure their own facility operations rather than merchants' goods and that merchants should verify their own policies extend to off-site inventory; that standard homeowner's coverage does not extend to business stock; that dropshippers retain product liability exposure as seller of record; and that a manufacturer's liability policy covers its own operations rather than the reseller's.
- Insurance broker reporting on pricing, giving business owner's policy costs of $67 to $118 monthly from two sources and an average of $359 monthly from another, a bundled policy with cyber from approximately $497 monthly, standalone cyber cover at $25 to $100 monthly for $1 million of coverage, and a functional minimum of $600 to $1,200 annually for stores under $250,000 revenue. All such figures originate from parties earning on placement, and the article reports the spread rather than an average.
- Insurance broker reporting that product category drives premium substantially more than revenue, including a comparison of a clothing brand and a supplements brand at $500,000 revenue with the latter paying roughly ten times more for identical limits; and on marketplace requirements including $1 million per occurrence at $10,000 monthly gross proceeds on one platform and $1 million per occurrence with $2 million aggregate at $100,000 twelve-month gross merchandise value on another. The widely quoted $4.4 million average data breach cost is an all-company figure dominated by large enterprises and is discussed critically in section 09.