Security that regulated insurers can rely on

In its region. Open runs separate deployments for each region it operates in, each with its own data store, keys and backups. Customer data isn't replicated between regions.

Only within your own instance. Your data, and your customers' data, can be used to train and improve the models that serve your program, and is never used to train models for any other customer. The same restriction applies to Open's sub-processors. Open uses only aggregated, de-identified operational data to run and improve the service.

Access is role-based and limited to what each role needs, with single sign-on and audit logs on every console action. Access from outside a region is logged and can be reported to you.

Encrypted in transit and at rest, on secure cloud infrastructure, with continuous monitoring by an in-house security team.

You agree the retention period with us, in line with the regulatory record-keeping rules for each product. On your written instruction, Open deletes data within an agreed period, subject only to legal hold, and confirms when it's done.

Open notifies you of a confirmed incident affecting your data within the hours set in your security addendum, followed by a written report. The incident process covers every region Open operates in.

Annual penetration tests by an independent CREST-accredited (or equivalent) firm, automated vulnerability scanning on every production release, and an independent SOC 2 audit each year. Reports and penetration test attestations are available under NDA.

Yes, for insurance distribution: Open Insurance Services UK Limited is authorised and regulated by the Financial Conduct Authority, and Open Insurance Pty Ltd holds an Australian Financial Services Licence. Security and compliance are run alongside those regulated operations.