My company runs a web application which (amongst other things) allows clients to store and share information. This is a service they pay us for.
My question regards insurance - what sort of policy do we need to cover this line of business? I'm coming at this without knowing much about insurance, so any information would be greatly appreciated.
We use a third party hosting provider for dedicated servers, but the software is entirely our own, minus some 3rd party modules.
Find a lawyer who knows something about the subject (ask your local Bar Association if you live in the US), and find what your potential liabilities and options are. Do not talk to an insurance agent without knowing the liabilities first.
That is the only advice you should take from random SO posters on this matter.
I think you hit the nail on the head when you mentioned insurance. A great option would be to speak with an insurance agent regarding this issue. Of course, you might find that you would be shocked at how much this insurance would cost - but at the same time, depending on the factors, it might be cheaper to do this than to pay a lawyer to look at your terms of service and privacy policy.
However, the biggest issue that you might find is that all your policies and contracts are already in place. If you brought a lawyer in now they might not be able to alter your contract with the third party hosting company. They would be able to take a look at your Terms of Service and EULA and see that they are waterproof.
You should be able to limit your liability through your TOS and EULA by establishing caps or requiring your users to submit to arbitration in case of injury.
In summation, first step is to check with an insurance agency (a quick Google search on corporate insurance, hosting insurance and the like) and then the next step is to contact a lawyer and get all your ducks in a row. More likely than not you won't run into a problem, but if you do...it's always good to have one of those stuffy guys in suit like me around.
There are a lot of insurance policies available today that can provide coverage for liability you would incur with the unintentional release of your customers information (either by you or by a hack, etc)... some programs will even provide coverage in case you are sued for release of a customers "trade secrets."
Working with your attorney to limit liabilities is one approach. Insurance as a means to mitigate the potential damage to your company is another way to manage your risks.
I would recommend going to a specialist in this area... a general insurance agent - state farm, etc - would not be of value for you and would not be able to get you a policy that would be appropriate for you.