24

I'm a web dev and I'm thinking about becoming a contractor.

I feel a little uneasy about the possibility of someone potentially trying to sue me. If, for example, a client wants an e-commerce website and I build one for them, and then the client gets hacked and incurs a financial loss, how do I stop myself from getting sued?

The way I see it is that it would depend on how they got hacked, but let's say it was because of a bug in the code that I originally delivered. That would then be on me and they could sue me, correct? But then what happens if more developers work on the code and they introduce a bug and the client thinks it's my fault and still tries to sue me? In either case, I'd like to know that something like this won't come back to hit me once I hand code over to a client.

Is there a clause that can be included in a contract that keeps me in the clear after the final hand-over takes place?

I understand that registering as a company and not as an individual protects you to a certain extent, but is there anything beyond that which can be included in the contract to give you complete protection?

Improve this question
2
  • 2
    The specific case of building an e-commerce website is worth exploring; here, the general problem of being sued by clients in the course of ordinary business was discussed, but e-commerce opens up an additional risks. In particular, PCI compliance, and each region may have their own additional rules. Maybe opening a separate question to focus on that might be worth doing.
    – Arafangion
    Jun 7, 2017 at 2:10
  • 1
    Just make sure you don't have any money. People only sue when they think there is money to be made.
    – Cicero
    Jun 7, 2017 at 19:26

3 Answers 3

Reset to default
33

Nothing gives you complete protection. You can (and should) have artfully drawn contracts with disclaimers and indemnification, but if the counterparties decline to comply with the contracts you may find yourself unable to remedy your liability even if you can prevail in litigation. Likewise, you can buy insurance to cover these sorts of risks. Insurers are regulated more tightly, but even they can fail or decide to litigate over payments. Finally, you can insulate yourself from personal liability by conducting business through a corporation. But even "the corporate veil" is not invincible.

It is quite common for a contractor or sole proprietor to use all of the aforementioned countermeasures to business liability. Consult a licensed attorney to ensure that they are properly implemented.

Improve this answer
3
  • 14
    This is pretty much the case for any software development. Use an LLC or corporation to more fully separate the work you do from your personal finances (so they can go after company assets, but not personal, at least not as easily), engage an insurance firm for Errors and Omissions insurance (I pay about $500/year for this), and write the contracts so that your liability is limited. Some contracts prevent damages from exceeding the cost of the services provided, so the worst case is essentially a full refund.
    – Adam Davis
    Jun 7, 2017 at 10:53
  • 2
    +1 starting a corporation is an important point also if you ever go bankrupt.
    – yo'
    Jun 7, 2017 at 20:08
  • 2
    You should have a lawyer draft your contract, but it should make your customer responsible for determining that the software is suitable for their application. You should never represent that the software is suitable for any particular purpose, that should always be the client's job. You can even prohibit them from using the software in production until they certify to you that it is suitable.
    – David Schwartz
    Jun 8, 2017 at 12:27
12

You can never prevent someone suing you

Your contract with your client is about risk allocation - who assumes the risk and who pays for the risk.

In general, the least cost solution for everybody is that the person who can best manage the risk should assume the risk: many contracts ignore this sensible rule and try to shove risk off on a person who has no chance of dealing with it - the correct solution if that is you is to say "nope" and look for a different client.

Your contract to state what you are going to do and the risks you are going to assume and the price you charge should cover the work and the risk. It is perfectly sensible that you should assume the risk of someone hacking your code because you, not your client, are in the best position to mitigate that risk - the mitigation and the assumption of the residual risk are things you should price and charge for.

It is not sensible that you should assume the risk for subsequent changes to the code and your contract should say this. If your client insists that you do assume this risk (which you cannot manage) you should charge appropriately (i.e. lots) or walk away.

Notwithstanding, your contract gives you no protection against third-parties. For example, if your code causes damage to the site's users or breaches a law (e.g. EU privacy laws). They are not parties to the contract so they will not be suing you under it: they will be suing or prosecuting you under a statute or the common law of negligence (probably).

You can write an indemnity into your contract that if you do get sued then your client assumes that risk - your client will probably expect a hefty discount for assuming that risk. However, even if you have a perfect indemnity in your contract it is of no use to you if your client no longer exists when you get sued. In any event, you cannot claim an indemnity if you commit an offence: if you break the law you pay the fine or do the time. Further, you may have to sue your client to enforce the indemnity.

You can (and should) take out a professional indemnity insurance policy - this passes some of the risks on to your insurer providing that you comply with your insurance contract. An insurer is also responsible for defending any lawsuits against you.

You can also form a corporation and conduct your business through that. In general, your personal assets would not be at risk but if you are personally liable (e.g. for a crime) this will not help.

Improve this answer
3
  • Do you have an idea of a typical price of such risks? E.g. if I developed a software for a client and charged $10'000 for it, how much should I ask for assuming the risk related to bugs?
    – Dmitry Grigoryev
    Jun 7, 2017 at 15:32
  • @DmitryGrigoryev: You can get quotes for professional liability insurance specific to whatever you're interested in from insurance companies or agents. That would be an indication of the market price for transferring the risk.
    – feetwet ♦
    Jun 7, 2017 at 21:08
  • @feetwet some of the risk - there are excesses and exclusions in insurance as well as premium hikes if you have the temerity to make a claim.
    – Dale M ♦
    Jun 7, 2017 at 21:10
0

Something else you can do is, as part of the contract, include a software license agreement, such as: http://smallbusiness.findlaw.com/intellectual-property/sample-software-license-agreement-provisions.html

Take note of stipulations of 6 and 7, where the it says you are not liable for damages. To add extra protections against someone coming along and changing it is to add another clause saying that the licensee is not permitted to make changes to the software provided.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .