If you build or maintain ecommerce sites, this is one of the few business topics that lands directly on your side of the wall. The decisions that create the exposure are decisions you make in code, and the people who buy the insurance usually do not know they exist.
Most of the risk conversation around online stores is about payments, and payments are the part that is already handled. Your processor holds the card data. What you hold is everything else, and that is the part that shows up in a claim.
The Data You Store Is The Liability
Every store that takes an order ends up holding names, shipping addresses, email addresses, phone numbers and order history. None of that is card data, so none of it is covered by the reasoning that says the processor takes care of security. It is still personal information, and under CCPA and state breach notification statutes the business is responsible for protecting it and for telling people when it leaks.
The cost model is worth knowing because it is per record, not per incident. A breach affecting 10,000 customer records averages around $164 per record once you add notification, credit monitoring, forensic investigation and remediation. That is $1.64 million for a database most small stores would describe as small. The number scales with rows, which means every convenience feature that retains more history quietly raises it.
This is why data retention is a security decision and not a product one. Order history you keep forever because deleting it was never prioritized is liability you are carrying for free.
PCI Compliance Is Not Coverage
A hosted platform handling PCI compliance removes one specific category of risk. It does not remove the rest, and it does not pay for anything when something goes wrong. Compliance is a standard you meet. Insurance is who pays the bill. Teams conflate them constantly, usually in the form of a sentence like "we are on Shopify so we are covered."
The gaps that remain are the ordinary ones: an admin account without MFA, a third party script on the checkout page, an integration token in a repo, a backup sitting in an unsecured bucket, a former contractor whose access was never revoked. None of those are PCI failures. All of them are breach paths, and all of them are things a developer either introduced or can close.
What The Policy Actually Pays For
Cyber liability coverage typically pays for breach notification costs, credit monitoring for affected customers, the forensic investigation that determines what happened, legal defense if customers sue, and regulatory fines. For most small ecommerce businesses it runs $500 to $2,000 per year, against losses that reach six figures without much effort.
The forensic investigation line is the one developers should care about most, because that is the part that depends on you. An insurer wants to know what was accessed and when. If the logs do not exist, or retention was set to seven days, or the audit trail was never written, the investigation cannot bound the breach, and an unbounded breach is treated as the worst case. Logging and retention are not just operational hygiene, they decide the size of the claim.
The Takeaway
The useful framing is that the technical decisions and the coverage decisions are the same decisions viewed from two sides. What you retain sets the exposure. What you log sets how expensive proving it is. What you leave accessible sets how likely it is to happen at all.
Worth reading the coverage side too, since it explains what your client or employer is actually buying and where they think the boundary sits: business insurance for online sellers.