contract-law software liability insurance
How to mitigate the risk of getting sued by clients (web dev contracting)
<p>I'm a web dev and I'm thinking about becoming a contractor.</p>

<p>I feel a little uneasy about the possibility of someone potentially trying to sue me. If, for example, a client wants an e-commerce website and I build one for them, and then the client gets hacked and incurs a financial loss, how do I stop myself from getting sued?</p>

<p>The way I see it is that it would depend on how they got hacked, but let's say it was because of a bug in the code that I originally delivered. That would then be on me and they could sue me, correct? But then what happens if more developers work on the code and they introduce a bug and the client thinks it's my fault and still tries to sue me? In either case, I'd like to know that something like this won't come back to hit me once I hand code over to a client.</p>

<p>Is there a clause that can be included in a contract that keeps me in the clear after the final hand-over takes place?</p>

<p>I understand that registering as a company and not as an individual protects you to a certain extent, but is there anything beyond that which can be included in the contract to give you complete protection?</p>

<p>Nothing gives you complete protection.  You can (and <em>should</em>) have artfully drawn contracts with <strong>disclaimers</strong> and <strong>indemnification</strong>, but if the counterparties decline to comply with the contracts you may find yourself unable to remedy your liability even if you can prevail in litigation.  Likewise, you can buy <strong>insurance</strong> to cover these sorts of risks.  Insurers are regulated more tightly, but even they can fail or decide to litigate over payments.  Finally, you can insulate yourself from personal liability by <strong>conducting business through a corporation</strong>.  But even "the corporate veil" is not invincible.</p>

<p>It is quite common for a contractor or sole proprietor to use <em>all</em> of the aforementioned countermeasures to business liability.  Consult a licensed attorney to ensure that they are properly implemented.</p>

<h2>You can never prevent someone suing you</h2>

<p>Your contract with your client is about risk allocation - who assumes the risk and who pays for the risk. </p>

<p>In general, the least cost solution for everybody is that the person who can best manage the risk should assume the risk: many contracts ignore this sensible rule and try to shove risk off on a person who has no chance of dealing with it - the correct solution if that is you is to say "nope" and look for a different client.</p>

<p>Your contract to state what you are going to do and the risks you are going to assume and the price you charge should cover the work <em>and</em> the risk. It is perfectly sensible that you should assume the risk of someone hacking your code because you, not your client, are in the best position to mitigate that risk - the mitigation and the assumption of the residual risk are things you should price and charge for. </p>

<p>It is not sensible that you should assume the risk for subsequent changes to the code and your contract should say this. If your client insists that you do assume this risk (which you cannot manage) you should charge appropriately (i.e. lots) or walk away.</p>

<p>Notwithstanding, your contract gives you no protection against third-parties. For example, if your code causes damage to the site's users or breaches a law (e.g. EU privacy laws). They are not parties to the contract so they will not be suing you under it: they will be suing or prosecuting you under a statute or the common law of negligence (probably).</p>

<p>You can write an indemnity into your contract that if you do get sued then your client assumes that risk - your client will probably expect a hefty discount for assuming that risk. However, even if you have a perfect indemnity in your contract it is of no use to you if your client no longer exists when you get sued. In any event, you cannot claim an indemnity if you commit an offence: if you break the law you pay the fine or do the time. Further, you may have to sue your client to enforce the indemnity.</p>

<p>You can (and should) take out a professional indemnity insurance policy - this passes some of the risks on to your insurer providing that you comply with your insurance contract. An insurer is also responsible for defending any lawsuits against you.</p>

<p>You can also form a corporation and conduct your business through that. In general, your personal assets would not be at risk but if you are personally liable (e.g. for a crime) this will not help.</p>

<p>Something else you can do is, as part of the contract, include a software license agreement, such as:
<a href="http://smallbusiness.findlaw.com/intellectual-property/sample-software-license-agreement-provisions.html" rel="nofollow noreferrer">http://smallbusiness.findlaw.com/intellectual-property/sample-software-license-agreement-provisions.html</a></p>

<p>Take note of stipulations of 6 and 7, where the it says you are not liable for damages. To add extra protections against someone coming along and changing it is to add another clause saying that the licensee is not permitted to make changes to the software provided.</p>
