SUURA™ sends your team customer requests for historic records that arrive identity-checked, with signed authority and the records clearly named.
Discuss a pilotInsurer sign inPhoto ID and proof of address, verified before the request reaches you.
The customer's Letter of Authority comes with every request.
Respond securely in the portal, with an audit trail of every action.
Requests arrive in the SUURA portal. You search your systems and upload the documents. Nothing to build.
Requests go to a file or inbox your team already uses, and you return the result.
A secure connection to your systems so documents can return automatically, subject to your own checks.
We expect to launch with level 1. No insurer is connected at levels 2 or 3 today. You remain the data controller and decide what to release.
An illustration with invented people and policy details, showing the portal view your team would see.
Attached
Your reply
A customer asks for the personal data you hold about them under UK GDPR, and authorises SUURA™ to send the request for them. The legal deadline applies, normally one month. The request arrives with identity checked and signed authority attached, so you spend less time verifying and chasing.
A customer needs proof of their no claims discount for a new insurer. This is the request we propose for an insurer pilot: small, clear and easy to complete.
Subject access requests are made by customers using their own rights, with or without a pilot. A pilot gives you one place to receive and answer them. You decide what is released.
Target reply time during the pilot: 5 working days, to be agreed with you. You decide what is released.
Where something is not yet in place we say so. A security summary and data processing agreement are provided before any pilot starts.
| Area | Position | Status |
|---|---|---|
| Roles | You remain the data controller for your records. SUURA acts on the customer's authority, and the role split is set out in a data processing agreement. | Agreement offered |
| Registration | SUURA LTD is registered with the ICO (ZC281078). | In place |
| Access | Named staff sign in with their own accounts. Each action on a request is time-stamped in the audit trail. | Designed for the portal |
| Encryption | Encrypted in transit. Sensitive documents will also be encrypted at rest with separate keys. | At-rest keys planned before live data |
| Hosting and location | Hosting provider and data region will be named in the agreement. | To be confirmed |
| Retention | Documents are deleted after the request closes, on a retention period agreed with you. | To be agreed |
| Risk assessment | A data protection impact assessment is completed before live data is processed. | In progress |
| Certification | SUURA does not yet hold ISO 27001 or Cyber Essentials. We will answer your security questionnaire directly. | Not held |
| Level | How it works | Effort for you |
|---|---|---|
| 1 Portal | Sign in with a named account. Reply by upload. No integration. | Minutes to set up |
| 2 Assisted | Requests are sent to a secure file drop or shared inbox you choose. You return the result the same way. | Agree format and contact |
| 3 Direct link | A secure interface with authenticated requests and signed responses, so records can return automatically. Specification agreed per insurer. | Your technical team, scoped together |
Read the full security summary for IT and compliance teams. Levels 2 and 3 are offered once a pilot shows the volume is worth it.
Motor no claims discount letters only, through the level 1 portal. A few dozen requests, so no burden on your team.
About 90 days, long enough to see a few dozen real requests through with a review part-way. We are open to shorter or longer.
One named contact, and a person or inbox that can reply to requests.
Reply time, share of requests completed first time, and chasing avoided. Reviews at 30 and 90 days.
To be agreed. We would rather discuss it with you than set a price before we have seen real volumes.
Continue, widen to other records, or stop with your data deleted.
Photo ID and proof of address are verified, and the customer signs a Letter of Authority, before a request reaches you. You can still decline any request.
The legal deadline and your own duties as controller apply as normal. SUURA identifies the customer and carries the request, and does not change what you are required to release.
Mark it as not held or cannot release and give a reason. The customer is told.
Yes. A withdrawn request is removed from your queue and the withdrawal is logged.
You decide what to release. SUURA checks identity and carries the request. Responsibilities will be set out in the data processing agreement and pilot terms.
Only as long as needed to pass them to the customer, on a retention period agreed with you.
No. Level 1 is a web portal.