Insurance
AWS for Insurers and Insurance Brokers in Colombia
A claim arrives with photos, invoices and forms, and someone types them in by hand. CloudTing designs and runs a policy and claims platform on AWS that reads those documents automatically, keeps policyholder data encrypted and leaves the evidence the Superfinanciera, Colombia's financial regulator, asks for.
What we solve
- Claims with documents read automatically: photos, invoices and forms turned into data
- Policies and claims in an encrypted database, available across two AWS zones
- Sensitive health and life data encrypted with your own keys in AWS KMS
- Audit evidence: who did what, stored in an account nobody can delete
- Mandatory MFA on administration consoles
- A tested continuity plan, with RPO and RTO measured
Who it is for
- Insurers that want to move the core or claims out of their data center
- Insurance brokers with portals for clients and agents
- Claims teams that type documents in by hand
- Entities supervised by the Superfinanciera that need technical evidence for audits
What Colombian regulation requires
- Insurers and insurance brokers are supervised by the Superintendencia Financiera, so its cloud and cybersecurity rules apply to them.
- External Circular 005 of 2019 requires, among other things, encryption in transit and at rest, MFA on administration consoles, a provider with ISO 27001, and notifying the Superfinanciera before moving core processes to the cloud, with the data location and a diagram of the platform.
- External Circular 007 of 2018 sets the minimum requirements for managing cybersecurity risk.
- Life and health policies handle health data, which Law 1581 of 2012 treats as sensitive data, with stricter rules.
What we do not do
We do not give legal advice or certify compliance. We put the technical controls in place and leave the evidence (logs, configurations, recovery tests, the diagram the Superfinanciera asks for) so your compliance officer or auditor can confirm what applies to your entity.
Reference architecture
A typical pattern for policies and claims: AWS WAF and a load balancer in front, the application on ECS Fargate across two zones, policies in encrypted RDS Multi-AZ, photos and receipts in S3, and every new document triggers Lambda so Textract can read it. KMS, Secrets Manager, CloudTrail, Config and Security Hub cover encryption and evidence, and backups and logs go to an isolated account.
How we start
- 1Free review: we look at access, encryption, backups, cost and what evidence exists today
- 2Report with prioritized risks and a proposed AWS architecture
- 3Migration or fixes in stages, without stopping operations
- 4A real recovery test, with RPO and RTO measured
- 5Ongoing operations and support, if you need it
Frequently asked questions
Can an insurer use AWS?
Yes. The Superfinanciera regulated cloud use in External Circular 005 of 2019 instead of banning it. The entity must follow those rules and notify before moving core processes; we handle the technical side and prepare the information the notice asks for.
How well does Textract read claim documents?
Amazon Textract extracts text, tables and fields from invoices and forms. It usually reads most fields and flags the ones it is unsure about for a person to review, instead of typing everything from scratch. We test it with your real documents before deciding.
How do we protect policyholders' health data?
It is encrypted with your own keys in AWS KMS, access is limited by role, and CloudTrail records every lookup. Documents are uploaded through temporary links and are never public.
Do you certify compliance or give legal advice?
No. We are AWS consultants. We put the technical controls in place and deliver the evidence; the legal reading and certification come from your compliance team or an independent auditor.
Next step
AWS for Insurers and Insurance Brokers in Colombia