Security and data protection
Data protection and security, built for legal protection insurers
iudexnc is a Swiss software company based in Zurich. Our customers' case data is hosted in Switzerland, and model processing runs inside Microsoft's EU data zone. Our information security management system is aligned to ISO/IEC 27001:2022, and the certification process is under way. We process personal data under the GDPR and the Swiss Federal Act on Data Protection (FADP) on behalf of the insurer. Controls, subprocessors and data categories are published in our Trust Center.
At a glance
Hosted in Switzerland. Application, database and document storage run on Microsoft Azure in the Switzerland North region.
Model processing in the EU. Language models run in the Azure OpenAI Service inside Microsoft's EU data zone (Sweden Central region).
No training on customer data. Guaranteed by contract. Microsoft stores neither the inputs nor the outputs of our coverage checks, with no human review and no training.
Encryption. AES-256 at rest, TLS 1.2 or higher in transit. Key and role management following best practice.
Security programme. ISMS aligned to ISO/IEC 27001:2022, certification process under way. The status of every control is visible in the Trust Center.
Data processing agreement. A data processing agreement under the GDPR or the FADP with every insurer. Audit and access rights agreed by contract.
Data processing
Your case data stays in Switzerland and the EU
The iudexnc platform runs on Microsoft Azure in Switzerland (Switzerland North region), which hosts the application, database, document storage and text extraction. For the coverage check, case content is passed to the Azure OpenAI Service inside Microsoft's EU data zone (Sweden Central region). Microsoft has approved modified abuse monitoring for our resources: inputs and outputs are not stored by Microsoft, not reviewed by humans and not used to train models. Web access to the application is TLS-encrypted and enters through Microsoft's global edge network. Integration into your existing cloud is possible on request.
Personal data on behalf of the insurer
We process case data as the insurer submits it, including the personal data it contains, solely on behalf of and on the instructions of the insurer. The Trust Center lists the data categories.
Strict tenant separation
Each insurer works in its own logically separated environment with its own knowledge base. No cross-tenant learning, no mixing of case data.
One subprocessor for customer data
Microsoft is the only subprocessor with access to customer data: Azure hosting in Switzerland, Azure OpenAI Service in the EU, delivery of sign-in links in Europe. The basis is the Microsoft Products and Services Data Protection Addendum. The full list is in the Trust Center.
What we process
- Name, e-mail address and employer of users
- Claim and case documents, including the personal data they contain
- IP address and product usage data
What we do not process
- Passwords (sign-in via one-time links or single sign-on)
- Payment card data
- Biometric data
- Precise geolocation
Security programme
A management system aligned to ISO/IEC 27001:2022, certification process under way
Our information security management system (ISMS) is aligned to ISO/IEC 27001:2022, with a Statement of Applicability, a risk register and continuous monitoring of controls. The certification process is under way. The first internal audit and the first independent penetration test are part of this process; we publish schedule and status in the Trust Center.
Controls, publicly visible
Infrastructure security, organisational security, product security, internal security procedures, and data and privacy. The status of every control is updated continuously and visible in the Trust Center.
Secure development
Development, test and production environments are separated. Code and dependencies are scanned for vulnerabilities automatically and continuously. Security testing is part of the development lifecycle.
Access and logging
Access to systems and data is restricted by role and logged. Users sign in to the application without a separate password, via one-time links or single sign-on with Microsoft or Google.
Incidents and vulnerabilities
We notify affected insurers of security incidents as agreed by contract and support them with their own reporting obligations. Reports from security researchers are handled under our Vulnerability Disclosure Policy, in force since 18 September 2026; machine-readable contact details are published under /.well-known/security.txt (RFC 9116).
Regulatory framework
The European framework insurers work in
Insurers in Switzerland and the EU are subject to their own requirements on data protection, outsourcing and digital resilience. This is where we stand:
- GDPR and FADP
- iudexnc is the processor for the insurer's case data and the controller for users' account data. We sign a data processing agreement with every insurer. Storage and processing take place in Switzerland and the EU, which recognise each other as providing an adequate level of data protection.
- EU AI Act
- Our documented classification concludes that the coverage check is not a high-risk system under Art. 6 of the EU AI Act; it does not fall under Annex III, point 5(c) (risk assessment and pricing in life and health insurance). Outputs are non-binding recommendations, users are informed that they are working with an AI system, and every coverage decision is taken by the insurer's handler.
- DORA (Regulation (EU) 2022/2554)
- DORA applies to insurers in the EU, not to iudexnc directly. As their ICT third-party service provider, we support their obligations under Art. 28 to 30 by contract: incident notification, ICT security measures and resilience testing, audit and access rights, and exit and data export.
- FINMA
- iudexnc is not supervised by FINMA. We support Swiss insurers with their outsourcing requirements under FINMA Circular 2018/3 by contract: due diligence before contracting, ongoing monitoring, and audit and inspection rights for the insurer and FINMA, including over material sub-suppliers.
- BaFin and FMA
- For outsourcing under the insurance supervision acts (Germany, section 32 VAG; Austria, section 109 VAG 2016) our contract documents provide for the rights insurers need: instruction, information, audit and termination.
Governance in the product
The coverage decision stays with the handler
iudexnc takes over the coverage check, not the decision. Every recommendation states the status per dimension, covered, not covered or unclear, and cites the governing clause. Uncertainty is flagged, not papered over. Every recommendation is versioned and exportable, as an audit-proof record in your claims or CRM system or in the iudexnc interface. There is no automatic decline: the handler reviews the recommendation and makes the call.
Due diligence
Verify us
The Trust Center shows the status of our controls, our subprocessors, the data categories we process and all updates. Policies, test reports and further documentation are available to insurers on request under a non-disclosure agreement. We answer the security questionnaires of your IT, data protection and legal teams directly.
Frequently asked questions
Questions from IT, data protection and legal teams
Where is our data stored and processed?
Stored in Switzerland on Microsoft Azure (Switzerland North region). Model processing for the coverage check takes place in the Azure OpenAI Service inside Microsoft's EU data zone (Sweden Central region). Sign-in e-mails are sent via Azure Communication Services in Europe. Web access is TLS-encrypted and enters through Microsoft's global edge network.
Is our data used to train models?
No. This is excluded by contract. In addition, Microsoft has approved modified abuse monitoring for our Azure OpenAI resources: inputs and outputs are not stored by Microsoft, not reviewed by humans and not used for training.
What is iudexnc's role under the GDPR and the FADP?
For the insurer's case data we are the processor; for users' account data we are the controller. We sign a data processing agreement with every insurer, including the technical and organisational measures.
Is iudexnc ISO 27001 certified?
Not yet. Our ISMS is aligned to ISO/IEC 27001:2022, with a Statement of Applicability, a risk register and continuous monitoring of controls. The certification process is under way. The internal audit and the independent penetration test are part of the process; we publish the schedule in the Trust Center.
How is the coverage check classified under the EU AI Act?
Our documented classification concludes that it is not a high-risk system under Art. 6; Annex III, point 5(c) concerns risk assessment and pricing in life and health insurance. Recommendations are non-binding, users know they are working with an AI system, and the coverage decision is taken by the handler. We share the classification on request.
What does DORA mean for working with iudexnc?
DORA binds insurers in the EU, not iudexnc directly. As an ICT third-party service provider we support the obligations under Art. 28 to 30 by contract: incident notification, security measures and resilience testing, audit and access rights, exit and data export. For Swiss insurers we support the outsourcing requirements under FINMA Circular 2018/3 in the same way.
Who has access to our data?
Each insurer works in its own logically separated environment. Access by iudexnc is restricted by role to what is necessary and is logged. As the infrastructure provider, Microsoft is the only subprocessor with access to customer data, bound by the Microsoft Data Protection Addendum.
What happens to our data when the contract ends?
You receive your data as an export on request; we then delete it within the contractually agreed period and confirm the deletion.
How do I report a vulnerability?
Write to security-notifications@iudexnc.ai. Process, scope and our commitments are set out in our Vulnerability Disclosure Policy; contact details are published under /.well-known/security.txt (RFC 9116).
Questions from your IT, data protection or legal team?
Write to security-notifications@iudexnc.ai. Documentation and ongoing updates are in the Trust Center.