Regulated Canadian startups — fintech, health tech, proptech, AI/data, insurtech — face more underwriting questions than typical SaaS. Preparing the items below before approaching markets shortens quote turnaround and typically produces better terms on Professional Liability (Tech E&O) and Cyber.

This is buyer guidance and common underwriting practice, not a regulator-prescribed list. Summit is a Canadian commercial brokerage licensed across Canada ("Tech-enabled. Human-led."). Underwriting decisions remain with insurers; placement and advice remain with licensed Summit brokers.

1) Business model summary

• One-paragraph description of what the product does and for whom.

• Regulated activity, if any (money movement, lending, health data, personal information, advice).

• Jurisdictions where customers are located, with a note on US or EU exposure.

2) Revenue model

• How revenue is earned (subscription, transaction, usage, services).

• Current and forecast annual revenue.

• Customer concentration (largest customers as a share of revenue).

3) Contracts and MSAs

• Standard customer MSA / terms of service.

• Typical limitation-of-liability caps and indemnity language.

• Contracts that mandate specific insurance limits or coverages.

• Data Processing Addenda where personal or regulated data is handled.

4) Data handling

• Categories of data collected (personal, financial, health, biometric, children's).

• Volumes and retention periods.

• Where data is stored and processed (cloud provider, region).

• Alignment with PIPEDA and any applicable provincial or sectoral privacy regime.

5) Security controls

Underwriters commonly ask about:

• Multi-factor authentication on email, remote access, and privileged accounts.

• Endpoint detection and response (EDR) and email filtering.

• Patching cadence and vulnerability management.

• Immutable or offline backups with tested restore procedures.

• Access controls, logging, and secrets management.

• Secure development lifecycle for code that ships to customers.

6) Incident history

• Prior cyber incidents, privacy complaints, or E&O disputes — dates, scope, remediation.

• Prior claims or circumstances that could give rise to a claim under the new policy.

• Any regulatory inquiries.

7) Vendor and third-party dependencies

• Critical vendors (cloud, payments, KYC/AML, analytics, AI model providers).

• Contractual security and privacy obligations flowing to those vendors.

• Business continuity posture if a key vendor is unavailable.

8) Governance and change

• Cap table snapshot and current/planned board composition (relevant when D&O is bundled with PL and Cyber).

• Planned funding rounds, geographic expansion, or new product lines during the policy term.

Why this speeds quoting

Insurers price uncertainty. A complete, consistent submission lets underwriters quote on facts rather than assumptions, reduces back-and-forth, and typically produces firmer terms and fewer subjectivities. A licensed Summit broker helps assemble the submission and walks the client through trade-offs.

Related: see Summit's Cyber & Tech E&O Practice page for coverage detail and buying-process notes.

Service area: Canada (subject to licensing and market availability).