Identity and access management
Use individual accounts, role-based permissions, strong authentication where appropriate, prompt access removal and periodic access reviews. Administrative access should be limited and monitored.
Security & Data Protection
Production deployments should define identity and access management, least-privilege roles, encryption in transit and at rest, audit logging, backups, vulnerability management, incident response, data retention and disaster recovery. Do not upload real customer or policy data to an unverified demonstration environment. Security certifications must only be claimed after independent verification.
Security readiness for production systems
Important: Confirm feature availability, service commitments, legal text and contact details before relying on or publishing this information. Product capability is not a claim of regulatory approval or insurer partnership.
Security readiness for production systems
Data protection and retention
Define what data is collected, where it is stored, who can access it, how it is encrypted, how long it is retained and how it is securely deleted. Avoid using real customer information in demos or development unless properly authorised and protected.
Monitoring and incident response
Maintain relevant security logs, monitor suspicious activity, patch dependencies, test backups and document incident escalation. Recovery exercises should validate that backups can actually be restored.
Evidence before making claims
Publish certifications, audit outcomes, uptime commitments or regulatory compliance claims only when supported by current evidence. This page describes recommended practices and does not itself certify the platform.
Expanded guide · Insurance technology
Security and responsible technology practices
-
Access and identity controls
A production insurance platform should use individual accounts, strong authentication, least-privilege access and role-based permissions. Administrative privileges should be limited and reviewed periodically. Sessions, password recovery, account lockout and user deactivation need defined controls. Multi-factor authentication should be considered for privileged users and sensitive operations.
-
Protecting data through its lifecycle
Security planning covers collection, transmission, storage, use, sharing, retention and deletion. Use encryption in transit and appropriate protections at rest, separate development and production environments, manage secrets securely and avoid exposing confidential information in logs. Data retention and deletion schedules should reflect contractual, operational and legal requirements.
-
Monitoring, backups and incident response
Operational readiness includes logging of relevant events, alerting, vulnerability management, dependency updates, tested backups and documented recovery procedures. Incident plans should define decision-makers, containment steps, investigation, communication and restoration. Backups are useful only when restoration has been tested and access to backup copies is controlled.
-
Security claims must be evidenced
The controls listed here are a planning framework and should not be read as proof of a certification, audit result or completed security assessment. Before publishing a security claim, verify the implemented control, supporting evidence, scope and validity period. Customers should receive accurate information about hosting, subprocessors, availability commitments and incident notification terms.
Contact the Relevant Department
Choose whether you are a new or existing customer, select the product module and department, and share the details needed to route your request. Do not enter passwords, payment card data, or sensitive policyholder health information.
Department
- Sales & Product Demo
- Pricing & Commercial
- Implementation & Migration
- Technical Support
- Integrations & Partnerships
- Billing & Accounts
- Customer Success
- General Enquiries