Reviewed by Tom Moore, Agency Partner, CA Agency Insurance License 6003355
Last reviewed: 5/13/2026
Key takeaway: Using offshore contractors — developers, designers, virtual assistants, or any service provider based outside the US — creates insurance exposure that most standard business policies don't address directly. General liability, professional liability, cyber, and workers' compensation coverage can all have gaps that appear specifically because the work crosses international lines. This applies to any Spokane business contracting with workers in the Philippines, India, Eastern Europe, Latin America, or anywhere else outside US jurisdiction. The gaps are fixable. But you have to know they're there first.
You hired a developer in Ukraine or a customer service team in the Philippines because it made business sense. Good talent, reasonable rates, work gets done. What you probably didn't do was call your insurance agent and ask how that changes your coverage.
Most of them wouldn't have a clean answer anyway.
This isn't a niche problem anymore. Offshore contracting has moved from the domain of mid-market companies to small businesses, solo operators, and Spokane-based firms with five employees and a global freelancer list. The insurance industry hasn't fully caught up — which means the gaps are real and the default assumption (that your existing policy covers it) is usually wrong.
Here's what actually needs your attention.
Outline
What "offshore contractor" actually means for your insurance policy
Your business insurance was almost certainly written with domestic operations in mind. When your carrier underwrote the policy, they assessed risk based on where you operate, who does the work, and what legal environment governs disputes. An offshore contractor changes all three of those variables at once.
"Offshore contractor" for insurance purposes means any individual or entity providing services to your business who is not a US-based employee or US-based contractor subject to standard domestic labor and liability frameworks. That includes freelancers on platforms like Upwork or Fiverr, dedicated development shops overseas, outsourced back-office teams, and any foreign entity you've engaged under a services agreement. The contractual structure matters less than the jurisdiction — if the work is happening outside the US and touching your business operations, your policy needs to account for it. Most don't, by default. This is where the first set of questions for your agent begins: does your current coverage specifically address services performed or delivered by non-US contractors? If they have to look it up, that's your answer.
The general liability gap nobody talks about
General liability insurance covers bodily injury, property damage, and personal or advertising injury that arises from your business operations. What it almost never covers clearly: liability arising from work performed by independent contractors, particularly overseas ones.
The standard GL policy language typically requires that contractors you use either be scheduled on your policy or fall within the scope of your "operations" as defined in the declarations. An offshore contractor operating under their own business entity, in their own country, under their own terms — that's a gray zone. If a deliverable they produced causes harm to a third party (a client, a user, a downstream customer), the question of whether your GL responds depends on how your policy defines your insured operations and whether international contractor work is explicitly included.
When does offshore work trigger a GL exclusion?
The exclusion doesn't always appear as a clean line item. It shows up in how liability is allocated when a claim occurs. If a client sues your Spokane business because software your offshore dev team wrote caused a data loss event, your GL carrier will look at who built the product and where. If the answer is "a contractor in Vietnam with no US presence and no insurance you can verify," the coverage defense gets complicated fast. The safer structure: your policy should either schedule your significant offshore contractor relationships or your professional liability policy (if you carry one) should explicitly cover services delivered by subcontractors regardless of geography. Neither is automatic. Both are worth a conversation with your agent before the work starts.
Professional liability and errors your policy may not cover
If your business sells services — consulting, software development, marketing, accounting, design, or anything where a client is relying on your professional judgment and output — professional liability (E&O) insurance covers claims that your work caused them financial harm through an error or failure to deliver.
The catch: most E&O policies are written to cover the work of your employees and direct principals. Subcontracted work, especially offshore subcontracted work, can fall outside that scope depending on how the policy is written. If your offshore team produces deliverables that go directly to your clients under your business name, your E&O carrier may treat that as subcontracted professional services and ask whether your policy includes a subcontractor endorsement. Some do. Many don't. The practical test: look at your E&O policy's definition of "insured" and "professional services." If it doesn't explicitly include work performed by subcontractors on your behalf, you may be uninsured for errors made by your offshore team — even though the client is suing you, not them. The Insurance Information Institute has a solid breakdown of what professional liability covers and where its limits typically fall].
Data privacy exposure when contractors access your systems
This is the one most Spokane small businesses genuinely underestimate. If your offshore contractors have access to any of the following — customer data, payment information, employee records, login credentials, internal systems, CRM data, email — you have a cyber exposure that probably isn't covered under your current business owner's policy.
Cyber liability coverage is either a standalone policy or an endorsement, and it's built around incidents involving data your business holds. The moment you extend system access to a third party — especially one operating outside US jurisdiction where you have limited contractual recourse if something goes wrong — your attack surface expands and your cyber policy needs to know about it. Most cyber policies will ask during underwriting whether you use third-party vendors with access to sensitive data. If you answered "no" when the answer was actually "yes, we have a 12-person dev team in Pakistan with admin credentials," your claim can be denied on misrepresentation grounds. Not because you lied on purpose. Because nobody asked the right question. The NAIC has published guidance on how cyber coverage interacts with third-party vendor risk that's worth reviewing.
Washington State's data breach notification requirements
If a breach occurs and Washington State residents' personal data is involved — which it will be if you have any Washington customers — you're subject to Washington's data breach notification law under RCW 19.255.010. The law requires notification within 30 days of discovering the breach and applies regardless of where the breach originated. That means if your offshore contractor's system is compromised and your Washington customer data is exposed, the notification obligation falls on you. The penalties for non-compliance and the costs of notification (legal review, credit monitoring, customer communications) are exactly what cyber liability coverage is designed to offset. Without it, those costs come directly out of your business.
Workers' compensation: the assumption that gets businesses in trouble
Here's the version of this conversation that happens most often: a Spokane business owner hires offshore contractors, treats them as independent contractors, and assumes that because they're overseas, workers' compensation doesn't apply. That assumption is mostly correct — and partially dangerous.
Correct: US workers' compensation requirements don't typically extend to workers employed and operating entirely outside the US under foreign labor law. You're generally not required to carry Washington L&I coverage for a contractor in the Philippines. Dangerous: the "independent contractor" classification itself. If your relationship with an offshore worker looks more like an employment relationship than a contractor relationship — consistent hours, direction and control over how they do the work, exclusive or near-exclusive engagement with your business — some jurisdictions, including Washington State in certain circumstances, may reclassify that relationship. Washington L&I has specific criteria for what constitutes an employee versus a contractor relationship, and those criteria apply to your obligations regardless of where the worker is physically located if the business is domiciled here. If a reclassification happens, unpaid L&I premiums become your liability retroactively.
Contract structure affects your coverage more than you think
Your insurance policy and your contractor agreement aren't separate documents. They're linked, even if nobody told you that.
When a liability claim arises involving an offshore contractor, one of the first things your carrier will do is review the contract between you and that contractor. They're looking for indemnification language, insurance requirements, and how liability is allocated in the event of a third-party claim. If your contract has no indemnification clause, no requirement that your contractor carry their own liability coverage, and no governing law provision establishing US or Washington State jurisdiction, your carrier may view your business as having taken on more liability than it should have. That changes how they respond to the claim. The practical fix is straightforward: every offshore contractor engagement of meaningful scope should have a written agreement that includes indemnification language protecting your business, a requirement that the contractor maintain at minimum basic professional liability coverage, and a governing law clause. Your attorney should draft it once. You use the template going forward.
What Spokane business owners should actually do
Four things worth doing in order:
Pull your current policies and read the definitions section. Specifically look at how "insured," "your work," "your operations," and "independent contractors" are defined. If offshore contractors aren't mentioned or included, that's where your gap is.
Call your agent and ask directly. "I use offshore contractors for [specific type of work]. Does my current GL and E&O coverage extend to liability arising from their work?" Write down the answer. If the answer is vague, ask for it in writing.
Check your cyber policy or BOP cyber endorsement. If you have offshore workers with access to customer data, systems, or credentials, confirm that your policy's third-party vendor risk provisions cover that access. If it doesn't, ask for an endorsement or a separate cyber policy.
Review your contractor agreements. If you're using offshore talent without a written agreement, start there. A basic services agreement with indemnification and insurance requirements doesn't have to be expensive to draft. The absence of one is far more expensive when a claim hits.
If you're not sure where your coverage stands right now, the right move is a quick coverage review before the next project kicks off. We do these without a pitch attached — just an honest look at what you have and where the gaps are.
Get a quote or schedule a review here: ALL LINES INSURANCE
Frequently Asked Questions
Does my general liability insurance cover work done by offshore contractors?
Not automatically. Standard GL policies are written around your direct operations and employees. Work performed by offshore contractors — particularly those operating as separate foreign business entities — may fall outside your policy's scope. The answer depends on how your specific policy defines "your work" and "independent contractors." Ask your agent to confirm in writing.
Do I need separate insurance if I use freelancers on platforms like Upwork or Fiverr?
Platform terms don't provide insurance coverage for your business. The platform may offer limited dispute resolution, but if a deliverable from an offshore freelancer causes financial harm to your client, the liability claim comes to your business. Whether your existing professional liability or GL responds depends on your policy's subcontractor provisions. Review before assuming you're covered.
What is professional liability insurance and does it cover offshore subcontractors?
Professional liability (E&O) covers claims that your professional services caused a client financial harm through error or failure. Whether it covers errors made by offshore subcontractors working under your business name depends on the policy's definition of "professional services" and whether a subcontractor endorsement is included. Many policies exclude subcontracted work by default.
Does Washington State's data breach law apply if my offshore contractor causes the breach?
Yes. Under RCW 19.255.010, if Washington residents' personal data is compromised, the notification obligation falls on the business that holds that data — regardless of where the breach originated. If your offshore contractor was the entry point, you still bear the legal obligation to notify affected Washington customers within 30 days of discovery.
Am I required to carry workers' compensation for offshore contractors?
Generally no, if the contractor is employed and operating entirely under their own country's labor laws. But if the nature of your working relationship resembles employment rather than independent contracting, Washington L&I may treat the relationship differently. Misclassification of offshore workers can result in retroactive premium liability.
What should be in a contract with an offshore contractor to protect my business?
At minimum: an indemnification clause that routes third-party liability back to the contractor for work they perform, a requirement that they maintain professional liability insurance, and a governing law clause establishing which jurisdiction's laws apply to disputes. Without these, a claim involving their work defaults to a liability structure that likely favors the contractor, not you.
Can my cyber insurance policy cover a breach caused by an offshore contractor's compromised credentials?
It depends on how your policy handles third-party vendor incidents and whether you disclosed third-party access during underwriting. If you didn't disclose that offshore contractors have access to your systems and a breach occurs through that access, your carrier may dispute the claim on misrepresentation grounds. Confirm your vendor access disclosures with your agent.
Does the type of work the offshore contractor does change my coverage exposure?
Yes, significantly. A contractor producing written content creates different liability exposure than one with admin access to your CRM and customer database, or one writing code that integrates with your client's systems. The more technical access or direct client-impact the work has, the more important it is that your professional liability and cyber coverage specifically account for it.
