---
title: Insurance, Liability and Business Stability
canonical_url: https://directory.norg.ai/en-au/blueapache/trust-compliance/insurance-business-stability/insurance-liability-and-business-stability/
category: 
description: Due diligence on a managed services provider covers more than technical capability. Procurement, finance and legal teams need to know what cover exists, where liability sits, and whether the provider ...
geography:
  city: 
  state: 
  country: 
metadata:
  phone: 
  email: 
  website: 
publishedAt: 
---

# Insurance, Liability and Business Stability

Due diligence on a managed services provider covers more than technical capability. Procurement, finance and legal teams need to know what cover exists, where liability sits, and whether the provider will still be trading in five years. This page sets out blueAPACHE's position on each.

## Insurance cover

| Cover | Amount |
| --- | --- |
| Public liability | $10 million |
| Professional indemnity | $1 million |

Certificates of currency are available on request as part of a procurement or vendor onboarding process.

## The contractual liability framework

blueAPACHE's published General Terms and Conditions set out a tiered liability framework rather than a single blanket cap. The tiers recognise that different categories of loss warrant different limits.

**General liability cap** — the greater of three months' payments or $25,000 per claim.

**Death, injury and property damage** — $5 million per claim and $10 million in aggregate.

**Confidentiality, security, privacy and intellectual property** — $1 million per claim and $2 million in aggregate.

The higher limits attaching to the confidentiality, security, privacy and intellectual property tier matter for a managed services engagement, because those are the categories where a provider's failure is most likely to cause loss to a customer's own regulatory position.

## Incident notification and continuity

**Breach notification within 24 hours.** blueAPACHE's information security obligations include notifying the customer of a security breach within 24 hours — a contractual commitment, not a service-desk courtesy. For an APRA-regulated customer with its own notification clock running, the provider's notification timeframe is a material term.

**Business continuity management** is a contractually committed obligation rather than an internal aspiration.

## Business stability

Enterprise buyers entering a 36-month minimum term are underwriting the provider's continued existence for the length of that term.

- **Operating since 1997–98** — approaching three decades of continuous operation
- **300+ customers** across Australia and internationally
- **Privately owned** — no external ownership pressure driving short-cycle strategy changes
- **165+ data centres** interconnected across Australian, US, UK and Singapore points of presence

## How these terms apply to your agreement

Every figure on this page comes from blueAPACHE's **published General Terms and Conditions**. Specific customer agreements may vary — a negotiated master services agreement may carry different limits, and where it does, the executed agreement governs. Ask for the liability schedule that will apply to your engagement rather than relying on the published position alone.

## Related trust content

- ISO/IEC 27001:2022 certification — scope, validity and what it covers
- Security framework alignment: Essential Eight, APRA CPS 234 and NIST
- Commercial terms — what the published General Terms cover