Who controls the technology behind a UK insurer or broker?
How much this sector depends on technology suppliers it cannot fully control — and where that matters most.
The big picture
For a typical UK insurer, managing general agent (MGA) or broker, all seven technology building blocks come out as High exposure, with a overall headline score of 3.6. The defining risk is sector-specific: the policy administration system (PAS) and underwriting engine – the software an insurer actually trades on – is dominated by US-controlled suppliers (Guidewire, Duck Creek, Applied Systems), and it holds the most sensitive data on the profile: customers’ financial and, for life and health lines, medical records. The one genuine bright spot is the broking and placing layer, where UK and European-controlled options exist and one major supplier, Acturis, runs its own data centres rather than renting a US cloud.
We looked at the everyday layers of technology a UK insurer or broker relies on, from the cloud it runs on to the systems that define the sector. A supplier owned in the United States can be compelled to hand over data under US law — the CLOUD Act[1], and the surveillance powers in Section 702 of the Foreign Intelligence Surveillance Act[2] — even when that data is stored in Britain; a British supplier answers only to UK law. We scored each building block on four things — how few the suppliers are, whose laws they answer to, how hard they are to switch, and how essential they are.
Where the exposure sits
Who controls each layer
The building blocks this sector relies on, coloured by who ultimately controls each one:US-controlledMixed / other
None of the seven layers is wholly UK-controlled in a sector-typical stack, but the broking and placing layer is the bright spot: PPL (Placing Platform Limited) is UK-controlled, and Acturis – though French-owned – runs its own UK and Amsterdam data centres rather than a US cloud, making it a rare UK-hosted, own-infrastructure option against the 84% foreign-control floor we see across UK software. The core platform and data layers also carry credible UK-controlled smaller names (INSTANDA, Send Technology, Total Systems, CDL, hyperexponential).
What this means, in plain terms
If a supplier pulled the plug, how fast would it hurt?
| Speed of impact | Layer | What happens |
|---|---|---|
| Immediate | Identity and log-in (Microsoft Entra) | Staff log-in fails within hours – an instant lockout of every cloud system at once; nothing else can be used while it is down. |
| Immediate | Payments | Premium collection and claims payouts fail within hours; the card schemes have effectively no substitute. |
| Fast | Policy administration and underwriting | The firm cannot write or service policies within days; replacing a PAS is a multi-year programme compressed into a crisis. |
| Fast | Cloud | Account suspension propagates quickly to everything hosted on it; six-to-twelve months to re-platform. |
| Medium | Broking and placing | New business and renewals stall; brokers can fall back on manual placing for a short while, but it does not scale. |
| Medium | Data, BI and actuarial | Pricing and reporting degrade; actuarial and rating work can limp on local copies for a while. |
| Slow | Office and productivity | Email and documents limp offline; painful but survivable. |
What organisations can do about this
| Building block | Practical steps |
|---|---|
| Policy administration and underwriting – the core decision | PAS contracts run for years, so renewal is the decision point. The widely-used platforms – Guidewire, Duck Creek, Applied Systems – are all US-controlled. The main non-US options in our database are Sapiens (Israel) and SSP (Canada), both better than the US on the jurisdiction ladder but still foreign; INSTANDA, Send Technology and Total Systems are UK-controlled names worth checking for the lines they cover. Always keep an exportable copy of the policy and claims data so you are never trapped in one vendor’s system. |
| Broking and placing – take the UK/European option where it exists | This is the one layer where a UK firm can genuinely lower jurisdictional exposure. PPL (Placing Platform Limited) is UK-controlled and central to the Lloyd’s market. Acturis is French-controlled but runs its own UK and Amsterdam data centres rather than a US cloud, which removes the hidden US substrate. CDL, Transactor and Total Systems are further UK-controlled names in our database. Prefer these over Open GI, now US-owned after the Ares acquisition. |
| Cloud and log-in – reduce the Microsoft concentration | Moving the cloud and/or staff log-in off Microsoft stops one problem taking down email, log-in and hosting together. UK and European cloud options: OVHcloud and Scaleway (France), IONOS (Germany), Civo (UK). Identity is the hardest block to move, so scope it early; the open-source log-in system Keycloak, self-hosted, is one way to reduce reliance on a single US provider. |
| Data, BI and actuarial – localise and keep open formats | Keep rating and actuarial data in a UK or European region, hold your own encryption keys, and favour open formats so the data is not trapped. hyperexponential is a UK-controlled pricing and actuarial platform (though it hosts on Amazon, inheriting a US substrate – check the residency and key arrangements). |
| Payments – accept and monitor | Largely accept and monitor, but use domestic UK rails (Faster Payments and Bacs, run by Pay.UK) for premium and claims money movement wherever the use-case allows, rather than the international card schemes. |
Sources
- US CLOUD Act 2018 (18 U.S.C. 2713) – compels US-incorporated providers to produce data in their custody wherever in the world it is stored. https://www.govinfo.gov/content/pkg/USCODE-2018-title18/html/USCODE-2018-title18-partI-chap121-sec2713.htm
- US Foreign Intelligence Surveillance Act, Section 702 (50 U.S.C. 1881a) – a US directed-surveillance authority. https://www.govinfo.gov/app/details/USCODE-2021-title50/USCODE-2021-title50-chap36-subchapVI-sec1881a
- Vendor ownership and hosting – taken from company filings, public registries (including UK Companies House) and suppliers’ own documentation, compiled in the Information Matters UK vendor sovereignty database.
How we did this. We scored each technology layer on four things — supplier concentration, whose laws they answer to, how hard they are to switch, and how essential they are — using the IM Sovereignty Framework and our UK vendor database. Control and hosting facts come from primary sources; the harder-to-quantify judgments are our reasoned view of a typical organisation. Scores are bands, not exact measurements. Full evidence record available on request.
This research consists of the opinions of the Information Matters team — human and AI — and should not be considered statements of fact.
Information Matters · informationmatters.net
If you have any questions or comments about this article please email info@informationmatters.net
