You ship a product that stores other people’s data. The risks that come with it would never have touched you if you’d written a simple business logic API. Three decisions—each one easy to dismiss at launch—determine whether you run a viable business or face a liability that could cost tens of thousands of dollars. And that liability isn’t necessarily the company’s. It’s yours.
The first is cyber insurance. A policy caps your losses if a security incident happens. The cost varies widely. According to TechInsurance, small companies pay an average of roughly 1,550 dollars per year, with the full range starting at a few hundred and climbing beyond 8,000 dollars annually, depending on coverage limits and the type of data you store. But insurers don’t cover everything. They demand clearly defined minimum security practices. Multi-factor authentication appears as a constant requirement in nearly every assessment. Access controls, system updates, and encryption are mentioned frequently as factors that lower the premium. Without these controls, you won’t get a policy at all.
The second is reading your backend provider’s terms carefully. If you use Supabase, for example, the terms cap each party’s liability at amounts paid or owed in the last twelve months. For an app running at 25 dollars a month, that translates to roughly 300 dollars in case of a claim. But important exceptions exist: breaches of confidentiality, fraud, and gross negligence don’t qualify for that low cap. Liability for these rises to three times the twelve-month sum. Your provider also excludes indirect damages, lost profit, and data breaches themselves. The takeaway is clear: your provider doesn’t cover you the way you think.
The third is GDPR. If you store data in the European Union or about EU residents, the regulation applies. Article 17 recognizes the right to deletion. If a privacy policy promises deletion but your database doesn’t actually support it, that’s a violation. The penalties are severe: Article 83(5) sets fines up to 20 million euros or 4 percent of annual global turnover, whichever is larger.
These are facts, not legal advice. Jurisdictions differ, and liability depends on your location and circumstances. But you can’t ignore these three questions before you launch.
