Assessed against the rules that apply to you
AutoImpact has been assessed requirement by requirement against the accounting, data protection, data quality and ICT rules that apply to a life insurer in Luxembourg and the UK. Each requirement is mapped to the control that meets it.
| Standard | What AutoImpact does | Status |
|---|---|---|
| IFRS 17 Insurance Contracts | Measurement (GMM, VFA), the CSM, the risk adjustment, transition and disclosures 100-109, 119. | Implemented |
| Lux GAAP | Unit-linked reserves on the basis note's definitions. | Implemented |
| GDPR, UK GDPR and the Data Protection Act 2018; Luxembourg data protection law | Minimisation on upload, pseudonymisation, special-category masking, retention and the record of processing. | Software controls met |
| Solvency II and Solvency UK: data quality for technical provisions | Completeness, accuracy and appropriateness checks, reconciliation, lineage and limitations. | Software controls met |
| DORA (EU 2022/2554): ICT risk management | Logging, access control, backup and restore, the security log outside the application's reach. | Logging and access met |
| CAA (Luxembourg): vendor access, LC 22/16 | Time-limited, read-only vendor support access approved by the security officer. | Software controls met |
| FCA SYSC 13.7 and PRA expectations | Access, change control and operational resilience of an end-user application. | Software controls met |
| ISO/IEC 27001:2022 Annex A | The controls an application provides, mapped to AutoImpact's. | Controls mapped |
| OWASP ASVS 5.0 Level 2 | 253 requirements assessed and re-tested twice: 169 of the 199 that apply are met at the last re-test; the rest are tracked in a published register. | Partly met |
These are Dalsin's own assessments of the software, not certifications or legal opinions. Controls that depend on your deployment (hosting, retention periods, contracts) are listed for you to complete. An independent penetration test and ASVS verification are planned before production use.
Tested on every build
Automated tests
The full test suite runs on every change, on SQLite and PostgreSQL, including recalculating the reviewer workbooks.
Security scanning
Static analysis of the code, known-vulnerability checks on every dependency and a software bill of materials with each build.
Installed and started
The Docker image runs as a non-root user on a read-only file system; the Windows installer is installed, started and signed into on a clean machine.
See the assessment
We'll share the compliance assessment, the ASVS register and the methodology documents.
Or email hello@autoimpact.co.uk · Ask for the brochure