AI gateway for insurers, with the controls an outsourcing review asks for
Standard Compute is the AI gateway insurers use to put Claude, GPT and open models to work on claims, underwriting and customer service, with the controls a DORA and Solvency II outsourcing review asks for. Through one API, each step goes to the cheapest model that can do it.
Policyholder and health data stay under the insurer's rules: processed in Europe, kept by no provider, never used for training, handled only by approved providers, and recorded request by request for 12 months.
Create a company accountor write to contact@standardcompute.com
The short answers
- Can claims handlers use AI on policyholder data without it being stored?
- Turn on zero data retention and every request goes only to inference endpoints that commit to keeping no copy. Standard Compute processes prompts in memory and never writes them to storage or logs.
- What does the outsourcing and DORA review get?
- A Europe rule, a published sub-processor list with 14 days' notice of changes, a DPA signed in the dashboard, provider allow-lists that fail closed, and a 12-month record of every request with model, provider and region rule.
- Can underwriting and claims use different models?
- Decide which models each key can use, so every app and every person gets exactly the models you approve. GLM, DeepSeek and MiniMax run on European providers for Europe-restricted workspaces.
Your requirements, mapped to product controls
What an insurer's risk function and data protection officer check before policyholder data reaches an AI model, and the control that answers each one.
| What the sector asks for | How Standard Compute handles it |
|---|---|
| Data location for the ICT third-party register | Set a Europe rule for the company, a team or a single key. Every request, including retries and fallbacks, is served only by approved European inference endpoints, and a request no European endpoint can serve is refused before the prompt is sent. Account and usage records are stored in Frankfurt and the EU gateway runs in Finland. Request records hold metadata only (model, provider, tokens, cost and status), never prompts or outputs. |
| Sub-outsourcing known and notified | Sign the DPA in the dashboard in minutes: no training on your data, no retention of your content, breach notification within 72 hours. Every sub-processor is published, with 14 days' notice before a new one is added. |
| Policyholder and health data not retained or reused | Turn on zero data retention and every request is routed only to inference endpoints that commit to keeping no copy of your data. We process prompts in memory and never write them to storage or logs. Standard Compute never trains on your prompts or outputs. |
| Only approved providers | Choose exactly which inference providers may handle your data, for the company, a team or a key. Lower levels can only narrow the list, new providers never join without an admin's approval, and fallbacks never route around it. |
| Access through the insurer's identity provider | Connect Microsoft Entra ID or any SAML identity provider. Anyone on your verified domain joins the company automatically, and access to Claude Desktop and Claude Code follows your Entra groups through SCIM. |
| Audit trail for internal audit and the actuarial function | Every admin change is recorded with before and after values. Export a record of every request showing the model, the provider that served it and the region rule in force, kept for 12 months. |
| Continuity of claims operations | If a provider goes down, the request fails over to another approved provider of the same model without leaving your region or provider rules. Enterprise includes a 99.9% monthly uptime SLA with service credits. |
| Cost control per application and per person | Every person and app gets a fixed monthly budget that never overruns, with spending caps per key and for the whole company. |
Set it up in an afternoon
Create the company account
Invite colleagues by email, organize them into teams, and give every person and every app its own key.
Set the Europe rule and zero data retention
Set both for the whole company. Teams and keys inherit them and can never switch them off underneath you.
Connect Microsoft Entra ID
People sign in with their work accounts, and employees use Claude Desktop and Claude Code with their Microsoft work account through our EU gateway.
Approve providers and models, then sign the DPA
Choose which inference providers and models each key may use, set the budgets, and sign the DPA in the dashboard.
Regulation references
The rules buyers in this sector check first, linked to the official text. They are references for your own assessment.
Links checked 9 November 2026.
Questions from IT, security and procurement
- Is there a request-level record for internal audit?
- Yes. Export a record of every request showing the model, the provider that served it and the region rule in force, kept for 12 months. Request records hold metadata only, never prompts or outputs.
- Do you publish your sub-processors?
- Yes. We publish every sub-processor with its purpose, data and location, and give you 14 days' notice before adding a new one.
- Does Standard Compute sign a DPA?
- Yes. Sign our Data Processing Agreement in the dashboard in minutes. It commits us to no training on your data, no retention of your content, and breach notification within 72 hours.
- Is there an uptime commitment?
- Enterprise includes a 99.9% monthly uptime SLA with service credits, and requests fail over between approved providers of the same model inside your rules.
Read next
Other sectors
Create the company account, set the Europe rule and zero data retention, and your people can start the same day.