Custom Software for Insurance & InsurTech
Secure, flexible, and compliant architecture tailored for the unique challenges of the Insurance & InsurTech sector.
Vivek Mishra — Founder & Lead Architect, ERPStack
Quick Answer
In short: an insurance ERP has to close two ledgers from one set of facts. ERPStack builds custom insurance software that posts statutory and IFRS 17 balances from a single PostgreSQL event stream, ingests ACORD AL3 and ACORD XML, files through SERFF, exchanges X12 837 and 835, and can prove the 72-hour clock in NAIC Model #668.
Why Custom ERP for Insurance & InsurTech?
Operating in the Insurance & InsurTech sector requires a systems architecture designed for high scalability, operational flexibility, and strict regulatory compliance. Standard off-the-shelf software forces your teams to reshape their workflows to fit rigid software packages. A custom ERP for the Insurance & InsurTech industry maps directly to your exact business logic. Deployed to your secure cloud infrastructure (AWS or Azure), the system isolates database schemas, automates redundant reporting tasks, and scales without user seat licensing fees. This ensures your corporate data remains under your absolute control, eliminates vendor lock-in, and lowers long-term operational technology costs by up to 70% over a 3-year period.
Industry Pain Points
- Policy administration, claims and billing disagree: three systems, one policy number, no ERP of record
- Statutory accounting and GAAP kept as two ledgers reconciled by spreadsheet, never inside PostgreSQL
- ACORD AL3 and ACORD XML broker feeds re-keyed by hand into the policy administration system
- IFRS 17 contractual service margin computed outside the ERP ledger, so it never ties back to surplus
- Ceded reinsurance tracked per treaty in workbooks, never per layer, per cession or per reinsurer status
- NAIC Model #668 wants a 72-hour determination clock the claims ERP cannot evidence
Engineering Blueprint
Every insurance ERP argument turns on one fact a generic ERP never models: an insurer keeps two sets of books at once. Statutory accounting under the NAIC Accounting Practices and Procedures Manual is a different basis from GAAP, and IFRS 17 adds a third. ERPStack fixes those posting rules in a signed register before the first Drizzle ORM migration.
Statutory, GAAP and IFRS 17 from one stream
The NAIC’s Statutory Accounting Principles (E) Working Group maintains the AP&P Manual, where assets that cannot pay claims are non-admitted — struck off the balance sheet, taken out of surplus. IFRS 17, effective for annual reporting periods beginning on or after 1 January 2023, adds the contractual service margin: unearned profit in a group of contracts. ERPStack keeps one append-only PostgreSQL stream in Drizzle ORM and derives the statutory, GAAP and IFRS 17 views from it, so the annual statement blank and the CSM roll-forward come from identical rows. An insurance ERP is a ledger build before a workflow build, and ACID Compliance is the acceptance test. NetSuite and Odoo have no concept of a non-admitted asset.
ACORD is a family, not a format
When a broker offers ACORD data they mean one of several standards, and insurance builds stall when nobody names which: AL3 and ACORD XML for Property & Casualty, ACORD XML plus DTCC EDI files for Life & Annuity, and the Global Reinsurance & Large Commercial XML and JSON the Ruschlikon initiative uses for placing, technical accounting and settlement. ACORD has issued the paper forms since 1971. ERPStack lands them through a TypeScript service with Zod validation and applies Idempotency in API Design at the ACORD transaction key, republishing over REST and GraphQL so a re-sent endorsement cannot book premium twice.
// Drizzle ORM on PostgreSQL — one ACORD transaction, booked once
export const policyTxn = pgTable('policy_txn', {
policyNumber: text('policy_number').notNull(),
acordTxnId: text('acord_txn_id').notNull(), // AL3 / ACORD XML key
effectiveFrom: timestamp('effective_from').notNull(),
writtenPremium: numeric('written_premium', { precision: 18, scale: 2 }),
statutoryBasis: boolean('statutory_basis').notNull(),
}, t => [unique().on(t.acordTxnId)]);One policy number, three systems
Policy administration, claims and billing disagreeing is the defining insurance ERP failure, and it is a key problem, not a sync problem. ERPStack makes the policy number and coverage term the only join key, then hangs FNOL, reserve movements, subrogation and salvage recoveries off it as Event-Driven Architecture messages on Apache Kafka, replicating development triangles into a ClickHouse Analytics Database so OLAP vs. OLTP Database Partitioning keeps reserving off the transactional PostgreSQL tables. Ceded reinsurance is modelled per treaty, layer and cession with the reinsurer’s status attached, because NAIC Credit for Reinsurance Model Law #785 makes an unauthorised reinsurer post 100% collateral. Guidewire, Duck Creek and SAP S/4HANA are strong here, so we sequence rather than replace: the Strangler Fig Migration Pattern puts billing on the new system first and leaves legacy policy administration authoritative until reserves reconcile.
Our Solutions
- ACORD AL3 and ACORD XML ingestion into a PostgreSQL policy ledger, idempotent per transaction key
- Statutory, GAAP and IFRS 17 views derived from one append-only posting stream in Drizzle ORM
- FNOL-to-settlement claims on Apache Kafka behind an Immutable Audit Trail
- Ceded reinsurance per treaty, layer and cession, carrying authorised, certified and reciprocal status
- Next.js adjuster and broker portals with RBAC and SSO, and no per-seat insurance licence
- Producer licensing and appointments validated against NIPR before any commission accrues
Compliance & Security
In insurance the audit is the licence. ERPStack treats the NAIC Insurance Data Security Model Law #668 as a PostgreSQL schema requirement, not a policy document.
Model #668: a 72-hour clock you can evidence
Adopted by the NAIC in the fourth quarter of 2017 and technically edited in 2025, Model #668 gives an insurance licensee no more than 72 hours from determining a cybersecurity event to notify the commissioner, demands records of every event for at least 5 years, and adds an annual written certification to the domiciliary commissioner. ERPStack stamps determination time separately from discovery time in an Immutable Audit Trail, keeps it in PostgreSQL rather than a ticketing SaaS, and gates it with RBAC and SSO. Only licensees with fewer than 10 employees escape the programme section.Colorado 10-1-1 and model governance
Colorado’s amended Insurance Regulation 10-1-1 took effect on 15 October 2025, imposing governance and risk-management framework duties on life, private passenger auto and health benefit plan insurers using external consumer data, algorithms and predictive models; SB 21-169 adds the chief risk officer’s attestation. An insurance carrier using no ECDIS still files that attestation through SERFF as a File & Use filing. The NAIC’s Model Bulletin on the Use of Artificial Intelligence by Insurance Companies followed in December 2023, and its AI Systems Evaluation Tool was piloting in 12 states as of March 2026. ERPStack persists model version, input lineage and decision rationale as PostgreSQL rows under RBAC, promoted through GitHub Actions.DORA, Solvency II and the XBRL deadline
DORA, Regulation (EU) 2022/2554, has bound EU insurance and reinsurance undertakings since 17 January 2025, and Delegated Regulation (EU) 2025/301 sets the clock: initial notification within 4 hours of classifying an incident as major and no later than 24 hours from awareness, an intermediate report within 72 hours, a final report within one month. DORA also demands a register of every ICT third-party contract and threat-led penetration testing every 3 years, so ERPStack ships Terraform state, OpenTelemetry Observability traces and Sentry Observability Platform alerts behind a Bastion Host. Directive (EU) 2025/2 amends Solvency II from 30 January 2027, and the PRA’s PS18/26 moves the Matching Adjustment Asset and Liability Information Return out of Excel into XBRL for reporting dates on or after 31 December 2026.Health lines drag in HIPAA EDI
An insurance carrier writing health or supplemental lines inherits 45 CFR Part 162. The adopted standards are ASC X12N 837 professional, institutional and dental (005010X222, X223, X224), 835 payment/advice (005010X221), 834 enrolment (005010X220), 270/271 eligibility (005010X279) and 276/277 status (005010X212); from 26 May 2028 the claims-attachment standards add X12N 275 and HL7 C-CDA. ERPStack builds them as versioned TypeScript parsers with Zod schemas on AWS or Microsoft Azure, so HIPAA Compliance evidence is a query rather than a binder.
Standards we engineer to
- NAIC Insurance Data Security Model Law #668
- NAIC Annual Financial Reporting Model Regulation #205
- IFRS 17 Insurance Contracts
- Solvency II Directive 2009/138/EC
- DORA Regulation (EU) 2022/2554
- HIPAA 45 CFR Part 162
- SOC 2 Type II
Get the Blueprint
Download our comprehensive Systems Architecture Blueprint to see how we architect compliant solutions.
Download BlueprintMetrics & Integrations
Illustrative engineering targets for this sector — the SLAs and capacities we design and build toward, not a live service dashboard.
ACORD XML ingest into PostgreSQL
Statutory-to-IFRS 17 posting lag
Model #668 event record retention
Apache Kafka claim event lag
Integration: ACORD AL3
Integration: ACORD XML GRLC
Integration: SERFF
Integration: NIPR
Integration: ASC X12N 837/835/834
Integration: SAP S/4HANA
Implementation Process
Ledger basis register
A signed list of every statutory, GAAP and IFRS 17 posting rule the insurance ERP must satisfy.
ACORD interface contract
AL3 and ACORD XML maps in TypeScript, idempotent on the ACORD transaction identifier.
Policy, claim and billing schema
Drizzle ORM tables on PostgreSQL where one policy number and coverage term resolve to one record.
Reinsurance and reserving
Treaty, layer and cession tables driving loss-development triangles and IBNR from Apache Kafka events.
Model #668 evidence
72-hour determination workflow and five-year event records behind an Immutable Audit Trail.
Strangler Fig cutover
Billing moves first on Next.js; legacy policy administration stays authoritative until reserves reconcile.
Proven in Insurance & InsurTech
Real-Time Fraud Detection Platform
Real-time fraud detection and risk scoring platform
Read Case StudyFrequently Asked Questions
Because an insurance carrier keeps two ledgers. Statutory accounting under the NAIC Accounting Practices and Procedures Manual is a separate basis from GAAP — non-admitted assets leave the balance sheet and reduce surplus — and IFRS 17 adds a third. ERPStack posts one append-only PostgreSQL stream and derives all three views, so the annual statement blank reconciles.
One of several ACORD standards, and insurance projects stall when nobody names which. ACORD publishes AL3 and ACORD XML for Property & Casualty, ACORD XML plus DTCC EDI files for Life & Annuity, and Global Reinsurance & Large Commercial XML and JSON used by the Ruschlikon initiative. ERPStack pins family and version in Zod before any Drizzle ORM migration.
For core policy administration, usually buy. Guidewire and Duck Creek carry decades of property and casualty insurance depth in rating, forms and claims, and if your product set fits their model, buying beats building. Custom ERP development earns its place where those suites price badly: the statutory-to-IFRS 17 bridge, broker portals, cession detail. ERPStack builds alongside them.
SAP S/4HANA is a defensible insurance general ledger, usually the right answer when the group already runs it. What it will not give you is statutory sub-ledger detail: cession-level reinsurance, non-admitted asset treatment, reserve movement at claim grain. ERPStack builds that sub-ledger in PostgreSQL with Drizzle ORM and posts summarised journals into SAP S/4HANA.
It adds a clock and a retention rule. The Insurance Data Security Model Law #668, adopted by the NAIC in the fourth quarter of 2017, requires notice to the commissioner no later than 72 hours from determining a cybersecurity event, records of every event for five years, and an annual certification. ERPStack stamps determination time apart from discovery time.
It changes the model. IFRS 17 is effective for annual reporting periods beginning on or after 1 January 2023 and measures groups of insurance contracts, carrying a contractual service margin — unearned profit that unwinds over coverage. Neither the grouping nor the roll-forward survives a trial balance, so ERPStack stores contract-group identity on the PostgreSQL posting row.
Those adopted at 45 CFR Part 162. For a health insurance line: ASC X12N 837 professional, institutional and dental (005010X222, X223, X224), 835 payment/advice (005010X221), 834 enrolment (005010X220), 270/271 eligibility (005010X279), 276/277 status (005010X212). From 26 May 2028 the attachment standards add X12N 275 and HL7 C-CDA. ERPStack ships TypeScript parsers validated by Zod.
By storing the model, not only its output. Colorado's amended Insurance Regulation 10-1-1, effective 15 October 2025, requires a governance and risk-management framework for life, private passenger auto and health benefit plan insurers using external consumer data, algorithms and predictive models. ERPStack persists model version, input lineage and decision rationale as PostgreSQL rows under RBAC.
Yes. DORA, Regulation (EU) 2022/2554, has applied to EU insurance and reinsurance undertakings since 17 January 2025, independently of Solvency II. It requires a register of every ICT third-party contract and threat-led penetration testing every three years. ERPStack delivers that register as PostgreSQL tables with Terraform-managed infrastructure, not a spreadsheet nobody updates.
With an idempotency key, enforced in the database. ERPStack puts a unique constraint on the ACORD transaction identifier so an insurance policy transaction is booked exactly once no matter how many times AL3 or ACORD XML replays it. The API returns the original result on a repeat, which is Idempotency in API Design applied at the PostgreSQL layer.