ClaimsGateway (claimsgateway.com) and Solv state that they host data on Microsoft Azure in Australia. JAVLN states accredited Australian and New Zealand data centres. InsuredHQ hosts Australian clients on AWS in Sydney among other regions. Curium states ISO 27001 certification but not where it hosts. Certification and hosting are separate questions, so ask about both.
Key takeaways
- Only some claims software vendors publish where they host data, and fewer still publish a security certification of their own.
- A data centre's ISO 27001 certificate is not the vendor's certificate, so check whose name is on it.
- According to HWL Ebsworth, CPS 230 requires notice to APRA before a material offshoring arrangement, including where data will be located offshore.
- According to the OAIC, an organisation sending personal information overseas generally stays accountable for how the recipient handles it under APP 8.
- Hosting in Australia answers a residency question, but it does not on its own satisfy APRA's information security standard.
What does "secure" mean for claims software?
For claims software, secure means five things a buyer can check: a security certification held by the vendor, where the data is hosted, encryption in transit and at rest, access controls by role, and logs of who did what. Claims files hold injury details, bank accounts and identity documents, so each of the five matters.
A claims system concentrates sensitive information. A single file can hold a medical report, a driver's licence and the bank details for a settlement payment. So a breach of a claims platform is rarely a minor incident.
Australian buyers also answer to regulators. APRA-regulated insurers must meet CPS 234 on information security, and the CPS 234 claims guide explains what it asks of vendors. In addition, the Privacy Act governs personal information wherever the buyer sits.
Hosting location is a separate question from security. Data can be hosted in Sydney and still be poorly protected, or hosted offshore under strong controls. The data sovereignty guide covers where claims data should live and why.
How were these options assessed?
Each option was assessed on where the vendor says it hosts data, the security certification it publishes, and the access and logging controls it describes, alongside claims scope, who changes workflows, segments served and Australian presence. Every fact comes from the vendor's own pages, checked in October 2026. "Not stated" means the pages did not say.
Vendors describe security very differently. Some publish a full security page, while others mention a certification in an image and nothing more. As a result, this list reports what each vendor states rather than grading it. A procurement team should treat every row as a starting point for its own questionnaire.
The list is not a ranking. ClaimsGateway is listed first because this article is published by ClaimsGateway, and the ClaimsGateway security and compliance page sets out its own statements in full.
Which claims management software is hosted in Australia?
Four claims vendors reviewed here state Australian hosting for Australian customers: ClaimsGateway, Solv, JAVLN and InsuredHQ. Curium states ISO 27001 certification but did not publish a hosting location on the pages reviewed. The entries below set out each vendor's statements in the same fields.
1. ClaimsGateway
Best for: Organisations that want a configurable claims platform hosted in Sydney, with a published ISO/IEC 27001 certification.
Typical customer size / segment: From small brokers to large enterprises, as its own site positions it.
Key strengths:
- Hosted on Microsoft Azure in the Australia East region (Sydney), as its security page states.
- Its operating entity, Risk Management Gateway Pty Ltd, holds an ISO/IEC 27001 certified information security management system.
- Audit logs record system and user activity, and user, role and permission controls set who can act on a claim.
Claims scope: The whole product.
Who changes workflows: The business, without developers.
Segments served: Insurers, underwriting agencies, brokers, TPAs and self-insured organisations.
Australian and New Zealand presence: Hosted in Sydney.
Hosting, as published: Microsoft Azure, Australia East (Sydney).
Security certification: ISO/IEC 27001, held by its operating entity.
Access and logging, as published: User, role and permission controls; audit logs of system and user activity; "SSL on all traffic".
Watch-outs: Buyers who want policy administration, rating and billing in the same system as claims will be better served by a core insurance platform.
Pricing: Volume-based, set by annual claim volume, with unlimited users. Its pricing page listed plans from AUD 5,500 a year ex GST in October 2026. An implementation fee and a minimum 3-year term apply.
2. Solv
Best for: Employers and licensed self-insurers whose claims are mainly workplace injury and workers' compensation.
Typical customer size / segment: Large employers and self-insurers. According to Solv, its software is used by 70% of self-insurance licences and 32% of the ASX 100 (solv.com.au, October 2026).
Key strengths:
- Data "stored and backed up locally in Australia with Microsoft Azure", as its site states.
- Self-insurance compliance with legislation checks for each state.
- Return-to-work plans and multi-state caseload management.
Claims scope: Workplace injury and workers' compensation.
Who changes workflows: Not stated on the pages reviewed.
Segments served: Employers and self-insured organisations.
Australian and New Zealand presence: Australian company, with data held in Australia.
Hosting, as published: Microsoft Azure, in Australia.
Security certification: Not stated on the pages reviewed.
Access and logging, as published: Not described on the pages reviewed.
Watch-outs: It is built for injury claims, so property, motor and liability claims sit outside its scope. Ask for its certification and its scope.
Pricing: Not published.
3. JAVLN
Best for: Brokers and agencies that want a broking platform with claims, and a detailed public security statement.
Typical customer size / segment: Australian and New Zealand brokers, agencies and underwriters. Named customers include Aviso Specialty and BMS Insurance Group (javln.com, October 2026).
Key strengths:
- Data "hosted in accredited Australian and New Zealand data centres", as its security page states.
- Encryption in transit and at rest, multi-factor authentication and role-based access.
- File notes "timestamped at creation" that "cannot be altered".
Claims scope: One module of a broking and policy platform.
Who changes workflows: Not stated on its homepage.
Segments served: Brokers, agencies and underwriters.
Australian and New Zealand presence: Offices in Melbourne and Auckland.
Hosting, as published: Accredited Australian and New Zealand data centres. The cloud provider is not named on the security page.
Security certification: SOC 2 Type 2 audited, as its site states. It also cites "ISO 27001-certified data centres", which is the data centres' certification.
Access and logging, as published: Role-based access "reviewed and logged"; multi-factor authentication; round-the-clock monitoring.
Watch-outs: Claims is one function in a broking system, so an organisation with heavy claims volume should test the module's depth. Its trust centre referred to a 2023 SOC 2 report, so ask for the current one.
Pricing: Each product has its own pricing page. Rates were not reviewed for this article.
4. InsuredHQ
Best for: MGAs and smaller insurers that want policy, billing and claims together in one light cloud system.
Typical customer size / segment: Insurers, MGAs, brokers and insurtech start-ups. Named customers include Ivory Insurance and Insurance Wholesale (insuredhq.com, October 2026).
Key strengths:
- Hosted on AWS "in Frankfurt, North Carolina and Sydney", according to its privacy policy.
- A separate database for each client, so data from two clients "is never co-mingled".
- Annual testing "by a third party security agency", with Cloudflare as an added layer.
Claims scope: One of five capability areas in a policy-led platform.
Who changes workflows: Not stated on its homepage.
Segments served: Insurers, MGAs and brokers.
Australian and New Zealand presence: New Zealand based, with a Sydney hosting region.
Hosting, as published: AWS, with Sydney among three regions. Which region serves Australian clients is not stated.
Security certification: Not yet held. Its privacy policy says it is "in the process of achieving" ISO 27001.
Access and logging, as published: Not described on the pages reviewed.
Watch-outs: Confirm in the contract that Australian data stays in Sydney, since the policy names three regions. Certification is in progress, not held.
Pricing: Not published.
5. Curium
Best for: Brokers, agencies and insurers in Australia and New Zealand that want claims and compliance tools from one local vendor.
Typical customer size / segment: Brokers, agencies and insurers. Named customers include Balanced Underwriting and Blue Zebra Insurance (getcurium.com, October 2026).
Key strengths:
- ISO 27001 certification, as its homepage states.
- A compliance platform it calls "one source of truth for registers, controls and obligations".
- Claims products for brokers and for agencies and insurers.
Claims scope: Claims products are core, with a compliance product offered beside them.
Who changes workflows: The business. In September 2026 its site described a "No-code claims platform" with "No IT required."
Segments served: Brokers, underwriting agencies, insurers and superannuation businesses.
Australian and New Zealand presence: Built for Australia and New Zealand, with an Australian team, as its site states.
Hosting, as published: Not stated. Its privacy policy (September 2026) names cloud hosting providers among recipients and commits to APP 8 steps for any overseas disclosure.
Security certification: ISO 27001, as its homepage states.
Access and logging, as published: Not described on the pages reviewed.
Watch-outs: Its pages do not say where data is hosted, so a regulated buyer should ask for the hosting region in writing.
Pricing: Not published. In September 2026 its site described pricing as modular and not per seat.
What about global platforms with an Australian presence?
Global core platforms sell to Australian insurers, but their public pages rarely state an Australian hosting region. Guidewire, for instance, has added Australian content to Guidewire Cloud Platform, such as GST on claim payments. However, the pages reviewed did not state where Australian data is hosted. A buyer should ask, and get the answer in the contract.
The same applies to any vendor not listed here. A global platform may well offer an Australian region. What matters is whether the buyer's own data will sit there, including backups, support access and disaster recovery copies.
What should you ask a vendor before you sign?
Ask five questions in writing: which entity holds the security certification and what its scope covers, which region hosts production data and backups, where support staff access data from, what is encrypted and how, and what the audit logs record. A vendor that answers all five clearly has usually done the work.
Each question closes a common gap. First, a certification can belong to the data centre, the parent company or the product, and only the last one covers the software itself. Second, backups and disaster recovery copies sometimes sit in another country. Third, support staff in another country can mean offshore access even when the data sits in Sydney.
For APRA-regulated buyers, the answers feed a formal process. According to HWL Ebsworth, CPS 230 requires notice to APRA "before entering into, or when there is a significant change to, a material offshoring arrangement", including where data will be located offshore. So a vague answer on hosting becomes a regulatory question.
Privacy law adds a second layer. According to the OAIC's APP guidelines, an organisation that discloses personal information to an overseas recipient generally remains accountable for that recipient's handling of it. Claims data is full of personal information, so the hosting answer matters even outside APRA's reach.
Frequently asked questions
Which claims management software is hosted in Australia?
ClaimsGateway and Solv state that they host on Microsoft Azure in Australia, ClaimsGateway in the Australia East region in Sydney. JAVLN states accredited Australian and New Zealand data centres. InsuredHQ lists Sydney among three AWS regions. Each statement was checked on the vendor's own pages in October 2026.
Is ISO 27001 required for claims software?
No Australian law requires claims software to hold ISO 27001. However, it is the most common way for a vendor to show an audited information security management system. APRA-regulated buyers must assess a vendor's controls under CPS 234, and a current certificate with a clear scope makes that assessment easier.
Does Australian hosting satisfy APRA?
Not on its own. CPS 234 is about information security controls, not location, so an onshore vendor still needs to show its controls are adequate. Hosting matters more under CPS 230, which requires notice to APRA before a material offshoring arrangement, including data held offshore. Buyers should take advice on their own obligations.
What is the difference between data residency and data sovereignty?
Data residency is where data is physically stored, such as an Azure region in Sydney. Data sovereignty is which country's laws can reach that data. They usually go together, but not always. Data stored in Australia by a company headquartered overseas may also be subject to that company's home laws.
How do I check where a vendor hosts data?
Ask the vendor to name the cloud provider, the region for production data, the region for backups and where support staff access data from. Then check that the contract says the same thing. A security page or trust centre is a good start, but the contract is what binds the vendor.
About the author
ClaimsGateway builds cloud claims management software for insurers, underwriting agencies, brokers, TPAs and self-insured organisations in Australia and New Zealand. Every regulator figure in this article links to its source, and every vendor fact was checked on the vendor's own site on the date shown.
Related reading
- Claims software in Australia: the full market, beyond hosting and security.
- Claims audit and compliance software: tools for the compliance side of claims.
- APRA CPS 230 and claims: what operational risk rules mean for claims operations.
Sources
- HWL Ebsworth. "APRA CPS 230: implications for financial entities and their technology service providers." 28 September 2023. https://hwlebsworth.com.au/apra-cps-230-implications-for-financial-entities-and-their-technology-service-providers/
- Office of the Australian Information Commissioner. "Chapter 8: APP 8 Cross-border disclosure of personal information." APP Guidelines, version 1.3, October 2025. https://www.oaic.gov.au/privacy/australian-privacy-principles-guidelines/chapter-8-app-8-cross-border-disclosure-of-personal-information
- Guidewire. "Reinforcing Guidewire's Commitment to Australia and New Zealand Insurers." Checked 21 October 2026. https://www.guidewire.com/resources/blog/general-interest/reinforcing-guidewires-commitment-to-australia-and-new-zealand-insurers
- JAVLN. "Security and data protection." Checked 21 October 2026. https://javln.com/security
- InsuredHQ. "Privacy policy." Checked 21 October 2026. https://www.insuredhq.com/privacy-policy
- Curium. Home page, and "Privacy Policy" (25 September 2026). Checked 21 October 2026. https://www.getcurium.com
- Solv. Home page, checked 16 October 2026. https://www.solv.com.au
- ClaimsGateway. "Security and compliance." Checked 21 October 2026. https://www.claimsgateway.com/platform/security-compliance
