Industries Insurers

Automated screening, without an automated decision about a person.

General counsel don't reject a screening vendor over the technology — they reject it over the questions it can't answer: Art. 22 GDPR exposure, who is liable when a report is wrong, and whether "GDPR-compliant" was ever actually tested against revDSG. Indicium answers all three before you sign, not after.

§ 32 VAGEIOPArevDSGArt. 22 GDPR

from €79 per report·one of Germany's largest insurance groups is a client (NDA)·six-month satisfaction promise

See a sample report →

01 Where general counsel actually push back

Three questions a screening vendor rarely answers straight.

Is this an automated decision?

Art. 22 GDPR prohibits a solely automated decision with legal effect about a person. We build the process so it never is one — the software prepares, a person decides.

Who is liable if the report is wrong?

Liability allocation belongs in the contract, agreed before signing — including how our own cyber-insurance coverage factors into it, not discovered in a dispute afterward.

Is "GDPR-compliant" actually revDSG-tested?

A Swiss group needs more than a GDPR badge with a Swiss flag added. We treat revDSG as its own regime, not an afterthought.

02 Regulatory mapping

VAG-ready reports, with the mapping as your contract annex.

Insurers supervise their outsourcing under their own logic. We deliver the report already shaped for it, rather than asking your team to translate a generic vendor report into your framework.

Framework	What it requires	How Indicium documents it
VAG-Outsourcing (§ 32 VAG)	Insurance-specific outsourcing rules, BaFin supervisory & audit rights	Contract annex following § 32 VAG logic, with audit/instruction rights for you and your supervisor
EIOPA outsourcing guidelines	Concentration & substitutability risk assessment, register of outsourcing arrangements	Honest concentration/substitutability assessment; sample register entry on request
revDSG	Proportionality, data-subject rights, cross-border transfer logic distinct from GDPR	revDSG-native processing; CH↔EU transfer basis set out before signing
Art. 22 GDPR	No solely automated decision with legal effect about a person	Human final review at fixed trigger thresholds, four-eyes principle, audit trail

Separately named, not merged: §203 StGB and §43e BRAO professional-conduct confidentiality apply wherever a check touches a privileged relationship — a distinction we keep explicit in the contract rather than folding it into a generic data-protection clause.

03 Deployment & liability

Sovereign deployment on request. Liability allocated before signing, not after.

EU hosting as standard

Query and report data processed within the EU on AWS and Google Cloud EU infrastructure.

Sovereign option on request

For groups that need it, Telekom Cloud deployment is available — scoped with you before signing.

Cyber-insurance coverage

Indicium carries its own cyber-insurance coverage, relevant to how your outsourcing agreement allocates liability.

One of Germany's largest insurance groups already runs on Indicium — under NDA, so we don't publish the name, but we can speak to the engagement directly on a call with your team.

04 Matching depth to the case

From portfolio screening to the fraud-adjacent individual case.

Software-Report

Portfolio and provider screening at scale, from €79 — re-screened on schedule, not a one-off snapshot.

Hybrid

Software depth plus documented human review — for ambiguous, fraud-adjacent individual cases.

Boutique

Fully analyst-led work where the matter is complex enough to need it.

ExploreSoftware-Report →Hybrid & Boutique →Trust Center →Comparison →

FAQ What your general counsel will ask

Does Indicium make an automated decision about a person under Art. 22 GDPR?+

No. Art. 22 GDPR prohibits a solely automated decision with legal effect about a person, and Indicium does not make one. The Software-Report is a documented basis for decision — traffic-light assessment, dated sources, reasoned findings — that your team reviews and decides on. At defined trigger thresholds, a qualified analyst adds human final review under the four-eyes principle before the case is considered closed.

Is this built for Swiss revDSG, or is it GDPR with a Swiss flag on it?+

revDSG-native. We treat Switzerland as a jurisdiction with its own duties — proportionality, data-subject rights, cross-border transfer logic — rather than assuming GDPR compliance covers it. Where CH and EU requirements diverge, we document both, and we tell you up front which entity you are contracting with and what that means for third-country transfer.

How does liability allocate if a report turns out to be wrong?+

We set out the allocation in the contract before signing, not in the fine print afterward — and Indicium carries its own cyber-insurance coverage, which is relevant to how your outsourcing agreement allocates liability. What we do not do is claim an outcome guarantee: every report states its methodology, its dated sources and the explicit limits of what it can see.

What about § 32 VAG outsourcing requirements and EIOPA guidelines?+

We deliver the regulatory mapping as a contract annex in VAG-ready form, following the logic of § 32 VAG and the EIOPA outsourcing guidelines — audit, information and instruction rights for you and your supervisor, and an honest assessment of concentration and substitutability risk.

Can we get a sovereign or on-premises-adjacent deployment?+

Standard deployment is EU-hosted on AWS and Google Cloud EU infrastructure. For groups that need a sovereign deployment option, we offer Telekom Cloud on request — talk to us about your specific requirement before signing.

This page provides general information about Indicium's services and the regulatory frameworks named above (VAG, EIOPA guidelines, revDSG, GDPR). It does not constitute legal or regulatory advice and does not replace an assessment by your own counsel for your specific case. Regulatory mapping reflects our understanding of the cited frameworks and does not guarantee a particular compliance outcome or supervisory acceptance.

Automated screening, without an automated decision about a person.

Three questions a screening vendor rarely answers straight.

VAG-ready reports, with the mapping as your contract annex.

Sovereign deployment on request. Liability allocated before signing, not after.

From portfolio screening to the fraud-adjacent individual case.

Your outsourcing file, done before your GC asks for it.