Infrastructure

Infrastructure and architecture entirely within the EU

Our entire infrastructure runs on Microsoft Azure within the European Union, with 100% EU data residency and enterprise-grade security for the insurance industry.

Exclusively within the EU: all services run in Azure regions within the European Union.
100% EU data residency: no data leaves the European Union.
Multi-zone deployment: redundancy across multiple availability zones.
PaaS architecture: fully managed platform services for maximum security.

Azure infrastructure

Hosted in Azure regions within the European Union

Our entire infrastructure is hosted in Azure regions within the European Union. We use a PaaS architecture, where Microsoft is responsible for managing the underlying hardware and operating system.

Compute and processing

Azure SQL Database: fully managed relational database with built-in high availability and automatic backups.
Azure Machine Learning: secure ML environment for model training and inference within the EU.
Python runtime: application logic and data pipelines built in Python on Azure-managed compute.

Storage

Azure Storage Account: encrypted object storage for files and datasets, with access control via Shared Access Signatures and RBAC.

Network

Azure Virtual Network (VNet): isolated network environment with private endpoints for all services.
Network Security Groups (NSG): strict inbound and outbound traffic rules at network and subnet level.
Azure DDoS Protection: automatic detection and mitigation of volumetric and protocol attacks.

Data centre

Multi-zone deployment: services distributed across multiple availability zones for maximum resilience.
ISO 27001 certified data centres: Microsoft Azure data centres are ISO 27001, SOC 2 and C5 certified.

Data flow

From input to output, every step secured

All data passes through a structured pipeline from input to output. Every step is secured with encrypted connections and includes validation and privacy measures.

Input sources

Direct database connection: secure connection to client source databases via encrypted channels.
Manual upload: secure file upload via the portal with validation and virus scanning.

Processing pipeline

DBT validation: automated data validation and transformation via DBT (Data Build Tool) with built-in quality checks.
ML models: machine learning models for analysis and prediction. Client data is not used for general model training, unless otherwise agreed in the data processing agreement.
Privacy measures: pseudonymisation and data minimisation are applied before processing.

Output destinations

Portal: secure web portal with MFA protection for clients to view results.
API: RESTful API with OAuth 2.0 authentication for automated integrations.

End-to-end encryption

All communication between the above steps is encrypted. Data is encrypted both in transit and at rest.

Security measures

Multiple layers protect against attacks and data loss

Multiple security layers protect our infrastructure against unauthorised access, data loss and cyber attacks.

Network security

Network Security Groups (NSG): strict firewall rules that only allow necessary traffic at network and subnet level.

Encryption

Encryption at rest: all stored data encrypted via Azure Storage Service Encryption, with controlled key access.
Encryption in transit: all communication secured with modern transport protocols; details available on request under NDA.
Transparent Data Encryption (TDE): database encryption active on all Azure SQL databases.

Identity and access

Multi-factor authentication (MFA): personal accounts with multi-factor authentication via Microsoft Entra ID, where technically available.
Role-based access control (RBAC): least privilege principle with periodic review and revocation of access rights.

Monitoring and detection

24/7 Azure Monitor and Security Center: real-time monitoring of all infrastructure components and security events.

Backup and recovery

Daily full backup: automatic daily backup of all databases, configurations and application data, retained for 1 week.
Additional backups: differential backup every 24 hours (retained for 4 weeks) and transaction log backup every 10 minutes (retained for 3 months).

Monitoring and performance

Continuously monitored, with fixed recovery objectives

We continuously monitor our infrastructure to ensure optimal performance and availability for our clients in the insurance industry.

Continuous monitoring

24/7 monitoring: Azure Monitor and Security Center monitor all services, networks and endpoints in real time.
Proactive alerting: automated notifications for anomalous patterns, performance degradation and security events.

Availability

95% availability: committed monthly availability within the service window (Monday to Friday 08:30-17:30 CET).

Disaster recovery

RTO: 24 hours. Recovery Time Objective of maximum 24 hours following a disaster.
RPO: 8 business hours. Recovery Point Objective: maximum of 8 business hours of data loss in the event of a disaster.

Technical specifications

All components in one overview

Overview of our infrastructure components and configuration.

Category	Component	Details
Compute	Azure SQL, Azure ML, Python	PaaS-managed services within the EU
Storage	Azure Storage Account	Encrypted, RBAC access control
Network	VNet, NSG, DDoS Protection	Isolated network with private endpoints and encrypted connections
Backup	Full, differential and transaction log	1 week / 4 weeks / 3 months retention, RPO 8 business hours
Monitoring	Azure Monitor, Security Center	24/7 real-time monitoring with proactive alerting

Contact

Questions about our infrastructure?

Our Data Protection Officer is happy to assist you with questions about security, compliance or privacy.

Compliance and security: dpo@onesurance.ai (DPO Menno Kooistra)

Technical questions: support@onesurance.ai

Email our DPO →