Revenue-Based Insurance and Usage-Based Cover for Indian SaaS and Subscription Businesses

India's SaaS ecosystem generated estimated revenues of USD 16 billion in 2025, with over 1,500 SaaS companies serving domestic and international markets. Subscription-based businesses beyond SaaS, including media streaming, D2C subscription boxes, fintech platforms with recurring revenue models, and API-as-a-service companies, add another USD 4-5 billion. These businesses share a common financial characteristic: their revenue is variable, often highly volatile, and grows (or contracts) in ways that bear no relationship to the calendar year on which traditional insurance policies are based.

A standard fixed-premium insurance policy creates three problems for these companies. First, the premium is calculated on projected annual revenue at policy inception. If the company's ARR (Annual Recurring Revenue) doubles during the policy period, which is common for growth-stage SaaS companies, the company is underinsured for the second half of the year. The sum insured and the premium reflect the risk profile at inception, not the risk profile at the point of claim. If a cyber breach occurs when the company has twice the data volume and twice the customer base compared to inception, the policy limits may be inadequate.

Second, if the company's revenue declines, whether due to churn, market conditions, or a pivot, the company has overpaid for insurance that covers a risk level it no longer has. For a startup burning cash, every lakh of unnecessary expenditure matters. A fixed premium based on optimistic projections becomes a sunk cost that cannot be recovered.

Third, the annual renewal cycle creates a coverage cliff. At renewal, the insurer reassesses the risk based on the company's current profile. If the company has grown significantly, the renewal premium can jump 50-100%, creating a budget shock. If the company has experienced a claim or a security incident, the renewal terms may include higher deductibles, reduced limits, or exclusions that were not present in the original policy.

These problems are not unique to Indian companies, but the Indian insurance market has been slower than the US and European markets to develop flexible alternatives. The IRDAI's regulatory framework allows for adjustable premium structures, but most Indian insurers still default to annual fixed-premium policies because their underwriting models, billing systems, and accounting practices are designed for this format.

The emerging solution is insurance that scales with the business: revenue-linked premiums, usage-based cover that adjusts to data volumes or transaction counts, and dynamically adjustable policies that accommodate rapid growth or contraction. This article examines each model, assesses its availability in the Indian market, and provides practical guidance for SaaS and subscription companies seeking flexible cover.

Revenue-linked insurance ties the premium to the company's actual revenue rather than projected revenue. Instead of paying a fixed premium at inception based on an estimate, the company pays a deposit premium at inception and then adjusts at periodic intervals (monthly, quarterly, or annually) based on actual revenue figures.

The mechanics are straightforward. At inception, the company and the insurer agree on a rate per unit of revenue (for example, 0.15% of revenue for professional indemnity cover). The company pays a deposit premium based on estimated revenue for the first quarter. At the end of each quarter, the company reports actual revenue, and the premium is adjusted. If revenue was higher than estimated, the company pays the additional premium. If revenue was lower, the company receives a credit against the next period's premium or a return premium at policy expiry.

This model offers several advantages for SaaS companies. First, it aligns the cost of insurance with the company's ability to pay. A pre-revenue startup pays minimal premium, while a company that has achieved product-market fit and is scaling rapidly pays more as its revenue (and risk exposure) increases. Second, it eliminates the underinsurance problem because the sum insured scales with revenue, ensuring that the company is always adequately covered. Third, it smooths the renewal process because the insurer has continuous visibility into the company's revenue trajectory rather than discovering a dramatic change only at renewal.

In the Indian market, revenue-linked professional indemnity and cyber insurance are available from select insurers, primarily through specialty brokers. ICICI Lombard and HDFC Ergo have offered adjustable premium structures for technology companies on a case-by-case basis, though these are not standard catalogue products. International insurers accessible through the Indian reinsurance market, such as AIG, Chubb, and CNA Hardy, offer revenue-linked products as standard in certain technology segments.

The rate per unit of revenue varies by cover type and risk profile. For professional indemnity, rates range from 0.08% to 0.25% of annual revenue. For cyber insurance, rates range from 0.10% to 0.30% of annual revenue. For D&O insurance, the rate is less directly revenue-linked, as D&O risk is more closely correlated with fundraising history, board composition, and regulatory exposure, but some insurers offer revenue-scaled premium adjustments.

A practical challenge is the reporting mechanism. The company must provide verified revenue figures at agreed intervals, and the insurer must have systems to process mid-term premium adjustments. For SaaS companies that track MRR (Monthly Recurring Revenue) in real time through their billing platforms, providing monthly or quarterly revenue data is trivial. For companies with more complex revenue recognition (multi-year contracts, usage-based pricing with minimum commitments), the reporting methodology must be agreed at inception to avoid disputes.

While revenue is a useful proxy for risk exposure, it is not always the best one. A SaaS company's cyber risk, for example, correlates more closely with the volume of data it processes and stores than with its revenue. A company with INR 10 crore in ARR that processes 100 crore customer records has a fundamentally different cyber risk profile from a company with the same revenue that processes 10 lakh records.

Usage-based cyber insurance ties the policy's limits, sub-limits, and premiums to operational metrics that more accurately reflect risk. The most common metrics are data volume (number of records or terabytes of data processed), transaction volume (number of API calls, payment transactions, or user logins), and user count (number of active users or accounts).

The concept works as follows. At inception, the company and insurer agree on coverage tiers linked to usage metrics. For example, a cyber policy might provide INR 2 crore of cover for up to 50 lakh records processed per month, INR 5 crore for up to 2 crore records, and INR 10 crore for up to 10 crore records. As the company's data processing volume increases, the policy automatically upgrades to the next tier, with the premium adjusting accordingly. If the company experiences a volume decline, the policy downgrades to a lower tier.

This model is particularly well suited for API-first SaaS companies, data analytics platforms, and fintech companies whose risk exposure is directly proportional to their processing activity. A payment gateway that processes 1 crore transactions per month has ten times the card data exposure of one processing 10 lakh transactions, and the insurance should reflect this.

In the Indian market, usage-based cyber insurance is still nascent but growing. A few specialty MGAs (managing general agents) and insurtech platforms have introduced parametric or usage-indexed cyber products. International markets, particularly Lloyd's of London syndicates and Bermuda carriers, offer more mature usage-based products that Indian companies can access through brokers with international placement capability.

The technical enablement of usage-based insurance requires data connectivity between the insured and the insurer. Some insurers use API integrations with the insured's cloud infrastructure (AWS, Azure, GCP) to pull real-time data volume metrics. Others rely on periodic self-reporting with the right to audit. The integration approach provides more accurate pricing but requires the insured to grant the insurer access to operational data, which raises its own privacy and security considerations.

Premiums for usage-based cyber cover are typically quoted as a rate per unit of data or transactions. For example, INR 0.01 to INR 0.05 per 1,000 records processed per month, with a minimum premium floor. For a SaaS company processing 5 crore records per month, this translates to approximately INR 5 lakh to INR 25 lakh per annum, comparable to or slightly higher than fixed-premium alternatives but with the advantage of automatic scaling.

A third model, increasingly relevant for fast-growing Indian SaaS companies, is the dynamically adjustable policy. This is a standard annual policy that includes built-in mechanisms for mid-term adjustment of limits, sub-limits, and covered activities without the need for formal endorsements and the associated processing delays.

In a traditional policy, any material change in the insured's operations requires a mid-term endorsement. If a SaaS company expands into a new geographic market, adds a new product line, acquires another company, or doubles its employee count, each change must be notified to the insurer, and an endorsement must be issued with revised terms and additional premium. For a fast-moving SaaS company, this can mean multiple endorsement requests per quarter, each taking days to weeks to process.

A dynamically adjustable policy addresses this by defining a range of covered activities, geographies, and operational parameters at inception, with automatic adjustment provisions. For example, the policy might cover professional services delivered globally (not just in India) from inception, with a revenue-linked premium that automatically adjusts as the company expands internationally. Or the policy might include a blanket acquisition provision that automatically extends cover to any company acquired during the policy period with revenues up to a specified threshold (commonly INR 10 crore or 25% of the insured's revenue, whichever is lower).

The benefits are significant. First, the company avoids coverage gaps during the period between a material change and the endorsement being issued. Second, the administrative burden on both the company and the insurer is reduced. Third, the company can move quickly on business opportunities without worrying about insurance delays.

In the Indian market, dynamically adjustable policies are offered by a handful of insurers, primarily for technology companies. The wordings are typically based on international precedents (US and UK technology E&O and cyber forms) that have been adapted for Indian regulatory requirements. The key negotiation points are the automatic adjustment triggers (what changes are automatically covered and what requires notification), the premium adjustment mechanism (how the additional premium is calculated and when it is payable), and the reporting obligations (what the company must disclose at renewal about changes that occurred during the policy period).

SaaS companies should specifically negotiate the following dynamic provisions. Geographic expansion: the policy should automatically cover new markets as the company expands, without requiring country-by-country endorsements. Product launches: the policy should automatically cover new SaaS products or modules that fall within the company's general business description. Employee growth: the policy should automatically adjust for increased employee counts, particularly relevant for D&O and employment practices cover. Customer growth: the policy should automatically adjust limits or sub-limits as the customer base grows, ensuring adequacy of cover.

The premium for a dynamically adjustable policy is typically 10-15% higher than an equivalent fixed policy, reflecting the insurer's additional risk of providing broader automatic cover. For a SaaS company in a rapid growth phase, this premium uplift is a worthwhile investment against the risk of coverage gaps.

Flexible insurance models offer Indian SaaS companies practical advantages that extend beyond risk transfer.

Cash flow management is the most immediate benefit. A pre-Series A SaaS company with INR 50 lakh in ARR that pays INR 3 lakh in annual fixed premium for professional indemnity cover is allocating 0.6% of its revenue to insurance. If the same company can pay a deposit premium of INR 75,000 and then adjust quarterly based on actual revenue, the upfront cash outflow is reduced by 75%. This matters when every lakh of cash extends the runway by a few days.

For companies that have raised venture capital, flexible insurance demonstrates financial discipline and risk management maturity. Investors reviewing a portfolio company's insurance programme will note if the cover scales with the business. A fixed-premium policy with a sum insured based on last year's revenue signals that the company's insurance may be inadequate for its current scale. A revenue-linked or dynamically adjustable policy signals that the company's risk management keeps pace with its growth.

SaaS companies selling to enterprise customers in India and abroad frequently face insurance requirements in customer contracts. A Fortune 500 customer may require the SaaS vendor to carry professional indemnity cover of USD 5 million and cyber cover of USD 10 million. For a young SaaS company, buying these limits at inception based on projected revenue may be prohibitively expensive. A usage-based model that scales to these limits as the customer's data volume grows on the platform provides a pathway to meeting the contractual requirement without overpaying at the outset.

Regulatory compliance is another driver. SEBI's listing regulations require certain disclosures about risk management, and companies preparing for an IPO need to demonstrate that their insurance programme is adequate for the company's current scale and activities. A flexible insurance programme that adjusts automatically provides cleaner compliance documentation than a fixed programme that may be misaligned with the company's current operations.

Tax efficiency is a minor but real benefit. Insurance premiums are a deductible business expense under Section 37 of the Income Tax Act, 1961. A revenue-linked premium that is lower in lean months and higher in growth months aligns the tax deduction with the company's revenue trajectory, smoothing the effective tax impact. The Goods and Services Tax (GST) on insurance premiums (currently 18%) also scales with the premium, so lower premiums in low-revenue periods reduce the total GST outflow.

Finally, flexible insurance supports the M&A process. SaaS companies being acquired undergo extensive insurance due diligence. A buyer will assess whether the target's insurance is adequate and whether any coverage gaps could create uninsured liabilities post-acquisition. A dynamically adjustable policy with a blanket acquisition provision simplifies the buyer's diligence and can facilitate a smoother transaction.

The availability of flexible insurance products for Indian SaaS and subscription companies has improved significantly since 2023, but the market remains fragmented. Companies seeking these products need to know where to look and how to negotiate effectively.

Domestic insurers offering flexible structures include ICICI Lombard, which has developed a technology-sector E&O product with adjustable premium provisions for companies with revenue above INR 5 crore. HDFC Ergo offers a cyber insurance product with data-volume-based pricing for select risk categories. Bajaj Allianz has introduced a startup-focused package policy that allows mid-term limit adjustments at pre-agreed rates. However, these products are not widely advertised and are typically accessed through specialty brokers who have relationships with the underwriting teams.

International insurers accessible through Indian reinsurance arrangements provide more mature flexible products. AIG India, Chubb India, and Zurich (through its Indian operations) offer revenue-linked professional indemnity and cyber products that have been adapted from their global technology portfolios. Lloyd's of London syndicates, accessible through Indian brokers with London market access, offer bespoke usage-based products for SaaS companies, including parametric cyber covers that pay out based on predefined triggers (such as system downtime exceeding a specified threshold) rather than indemnifying actual losses.

Insurtech platforms are an emerging channel. Companies like Plum, Turtlemint, and Digit Insurance have introduced digital-first products that allow real-time policy adjustments. While these platforms have focused primarily on health and motor insurance, some are expanding into commercial lines with flexible pricing models. Plum's group health product, for example, allows SaaS companies to adjust employee counts monthly, which, while not strictly a usage-based commercial insurance product, demonstrates the infrastructure for flexible insurance management.

To access flexible products, SaaS companies should take the following steps. First, engage a specialty insurance broker with technology sector expertise and international market access. Generalist brokers who primarily place motor and health insurance will not have the market knowledge or insurer relationships to source flexible commercial covers. Second, prepare a detailed submission that includes historical MRR data, customer count trajectory, data processing volumes, and technology architecture. Insurers pricing flexible products need granular data to set the rate per unit of revenue or usage. Third, be prepared to share ongoing data. Revenue-linked and usage-based models require periodic reporting, and some insurers request API access to billing or cloud platforms. Fourth, negotiate the adjustment mechanism carefully. Ensure that the policy clearly defines how premiums are calculated at each adjustment point, what happens if the company fails to report on time, and whether there is a minimum premium floor that applies regardless of revenue.

Flexible insurance models are not universally superior to fixed-premium policies. There are scenarios where a traditional annual fixed policy is simpler, cheaper, or more appropriate.

For stable, mature SaaS companies with predictable revenue and low growth volatility, a fixed premium based on actual prior-year revenue may be more efficient than a flexible model. The administrative cost of quarterly or monthly reporting, and the accounting complexity of variable premiums, may outweigh the marginal benefit of alignment. If the company's revenue is growing at a steady 20-30% per year, the insurer can price the fixed premium to account for this growth, and the resulting simplicity may be worth the slight premium mismatch.

For companies with very small insurance budgets (annual premium under INR 2 lakh), the overhead of flexible pricing, including broker fees for structuring, insurer fees for mid-term adjustments, and internal resource costs for reporting, may exceed the savings. A fixed-premium policy is simpler and may be the only economically rational option.

Flexible models also introduce forecasting uncertainty for the company's finance team. If the premium adjusts quarterly based on actual revenue, the CFO cannot lock in the full-year insurance cost at the start of the fiscal year. For companies with tight cash management and investor reporting obligations, this uncertainty can be problematic. A compromise is to negotiate a collar: a minimum and maximum premium for the policy year, with adjustments only within that range. This provides the insurer with a guaranteed minimum premium and provides the company with a capped maximum cost.

Another consideration is the claims response. Some insurers offering flexible products are newer to the Indian market or operate through MGA structures that may not have the claims-handling infrastructure of established Indian insurers. Before selecting a flexible product, the company should evaluate the insurer's claims track record, the claims process, and the insurer's financial strength rating. A flexible premium structure is worthless if the insurer cannot pay claims promptly and fairly.

Regulatory considerations also apply. IRDAI's product filing requirements mandate that insurers file their products with the regulator before offering them. Some flexible structures, particularly parametric and usage-based models, may be offered under IRDAI's regulatory sandbox framework, which allows time-limited pilot products. Companies should verify that the product has been properly filed and is backed by an IRDAI-authorised insurer, to ensure that the policy is legally enforceable.

Finally, companies should consider the renewal dynamics of flexible products. A fixed-premium policy provides price certainty for one year. A flexible policy provides price certainty for each adjustment period but may be subject to rate changes at renewal. If the insurer decides to increase the rate per unit of revenue at renewal, the total premium can increase dramatically, particularly for a company that has grown significantly during the policy period. Locking in multi-year rate guarantees, where available, can mitigate this risk.

For Indian SaaS and subscription companies ready to explore flexible insurance, the following roadmap provides a structured approach.

Phase 1: Risk Assessment (Week 1-2). Map all insurance needs across the company's operations. For a typical SaaS company, this includes professional indemnity for software errors and service failures, cyber insurance for data breach and system compromise, D&O for director and officer liability, commercial general liability for premises and operations, and potentially product liability if the company sells hardware or embedded systems. For each cover, identify the risk driver: is the risk more closely correlated with revenue, data volume, user count, or transaction volume? This analysis determines which covers are best suited to flexible pricing.

Phase 2: Data Preparation (Week 2-3). Compile the data that insurers will need to price flexible covers. This includes 24-36 months of historical MRR or ARR data, customer count by segment, data processing volumes (records, API calls, storage), geographic distribution of revenue and customers, technology stack and security posture (certifications, penetration testing results), and claims or incident history. SaaS companies with strong financial operations will have most of this data readily available. Companies that do not track data volumes in detail should begin doing so.

Phase 3: Broker Selection and Market Approach (Week 3-5). Engage a specialty broker and request submissions from insurers offering flexible products. The broker should approach both domestic insurers (ICICI Lombard, HDFC Ergo, Bajaj Allianz) and international markets (Lloyd's syndicates, AIG, Chubb). Request quotes in both fixed and flexible formats for each cover to compare costs and benefits.

Phase 4: Policy Structuring and Negotiation (Week 5-8). Review the quotes and select the optimal structure for each cover. Some covers may be better served by a fixed premium (for example, D&O, which is less revenue-correlated), while others may benefit from flexible pricing (for example, cyber and professional indemnity). Negotiate the adjustment mechanism, reporting requirements, minimum and maximum premium corridors, and the insurer's data access requirements.

Phase 5: Implementation and Ongoing Management (Week 8 onward). Bind the policies and establish the reporting cadence. Assign an internal owner, typically the finance or legal team, who is responsible for providing data to the insurer at each adjustment point. Set calendar reminders for reporting deadlines, as missed reporting can trigger default provisions in the policy. Conduct a mid-year review to assess whether the flexible structure is delivering the expected benefits and adjust if needed.

The entire process, from risk assessment to policy binding, typically takes 6-10 weeks. Companies that are renewing existing fixed policies should begin the process at least 90 days before renewal to allow adequate time for market approach and negotiation. For first-time buyers, building the programme from scratch provides an opportunity to select the optimal structure without the constraints of existing policy wordings.