Immutable audit trail
Every action — report, status change, comment, file upload — is timestamped in a tamper-proof log. Solvency II and EIOPA examiners love this.
🛡️ Insurance
Whistleblowing software for insurers, brokers and reinsurers.
Insurance firms face strict whistleblower and governance obligations under the EU Directive, Solvency II and EIOPA guidelines — with personal liability for board members and approved persons. Ashio gives compliance teams a compliant, anonymous reporting channel that satisfies all of them.
2019/1937
EU Whistleblowing Directive applies to insurers
50+
Employees — minimum threshold for the directive
7 days
Mandatory acknowledgment deadline
€20/mo
Ashio annual plan, transparent pricing
Overview
Why insurance needs a dedicated whistleblower channel.
Insurance carriers, brokers and reinsurers operate under strict governance regimes: Solvency II Pillar II, EIOPA guidelines, IDD distribution rules, and the EU Whistleblowing Directive. With approved persons personally liable for governance failures, the stakes are high. Ashio provides the compliant, anonymous intake that satisfies every regime — with an immutable audit trail that satisfies EIOPA examinations and Solvency II Pillar II requirements.
Regulatory landscape
What applies to your organisation.
The whistleblower and governance stack that insurance firms must navigate.
EU Whistleblowing Directive 2019/1937
All legal entities with 50+ employees — including insurers — must operate a confidential reporting channel with anonymous intake, 7-day acknowledgment and 3-month feedback.
Solvency II Pillar II
Solvency II requires insurance undertakings to have effective governance arrangements including whistleblowing. National supervisors expect documented, auditable channels.
EIOPA Guidelines on the System of Governance
EIOPA expects effective whistleblowing arrangements as part of the system of governance. Approved persons must demonstrate oversight of these arrangements.
Insurance Distribution Directive (IDD)
Insurance distributors (brokers, agents) must comply with governance and conduct rules including effective internal reporting. Ashio is jurisdiction-agnostic across all EU member states.
Broader regulatory landscape
Beyond Solvency II and IDD, insurers must also consider broader governance, conduct and reporting obligations under national law. Ashio supports categorization that lets you map each of these into the appropriate routing and reporting workflow.
Why Ashio
Built for the insurance sector.
Every feature exists because an insurance compliance officer needed it.
Anonymous by default
Reporters stay anonymous unless they choose otherwise. No IP, no cookies, no third-party trackers on the reporting form. Critical for sensitive insurance fraud reports.
Approved-person ready
Per-case access controls. Standard access reviews are recommended per regulatory guidance.
Multi-entity for groups
Configure per-entity routing for insurance groups, brokers, MGAs, and reinsurers. One tenant, multiple reporting channels, segregated audit trails.
Categorized intake by report type
Reports can be categorized on submission and routed to the appropriate team — insurance fraud to investigations, broker misconduct to compliance, claims irregularities to audit.
Configurable data retention
Set retention periods that match your regulatory requirements. Export data at any time during the retention window.
Compliance checklist
What insurance compliance officers worry about.
Five concerns we hear every week from compliance teams at insurers and brokers — and how Ashio handles each.
- 1
Can EIOPA actually audit our reporting chain?
Ashio's immutable audit log timestamps every action with user, role and timestamp. EIOPA examiners and national supervisors accept the export — no manual reconciliation needed.
- 2
Will senior management ever see a report about themselves?
Access controls ensure that only your designated staff can read reports. Standard access reviews are recommended per regulatory guidance.
- 3
How do we prove we acknowledged within 7 days?
Reports are timestamped on receipt. You can export logs at any time to demonstrate compliance with your regulatory obligations.
- 4
What if we operate across multiple branches or jurisdictions?
Multi-entity tenants support per-branch routing with per-jurisdiction audit segregation. Same platform, multiple legal regimes.
- 5
How do we onboard 50+ branches under one group policy?
Multi-entity tenants with per-branch routing, group-level oversight and segregated audit trails. Onboard one branch per hour, not per week.
FAQ
Common questions from insurance compliance teams.
Is the reporting channel compliant with the EU Whistleblowing Directive?+
Yes. Ashio is designed to meet the Directive's requirements: confidential intake, anonymous submission by default, 7-day acknowledgment, and 3-month feedback. Final compliance depends on your own configuration.
Can staff or third parties report from a phone?+
Yes. The reporting form works in any modern mobile browser. No app install required.
Who in our organization can see reports?+
Only the people you designate as compliance staff, with role-based access controls. IT cannot read report contents or reporter identity.
What happens to report data after we close our account?+
Data is deleted on a configurable schedule. You can export all data before closing.
Can I try Ashio before committing to a paid plan?+
Yes. A 14-day free trial is available, no credit card required.
Related
Continue exploring.
Ready to set up a compliant channel?
Live in 10 minutes. €20/month annual. ISO 27001 hosted. Solvency II ready.