Protected communications for insurers
Q-AUDION keeps claims files, expert reports and conversations with intermediaries and reinsurers readable only by the people involved, including in a crisis room with many participants.
Sensitive files, many parties, one claim
A claim brings together policyholders, loss adjusters, lawyers, intermediaries and reinsurers, who exchange documents and talk about money and personal data.
Claims, expert reports and crisis units
Loss adjusters, experts, lawyers and claims handlers exchange reports, photos and recordings, including health data. After a major event, a crisis unit coordinates many people at the same time.
Intermediaries and reinsurers
Conversations about terms of cover, large risks and settlements with intermediaries and reinsurers are commercially sensitive and should stay between the parties.
Customers' personal data and the ICT supply chain
Insurers process the personal and health data of their customers and rely on ICT providers. The communication tools used for this work have to protect that data and to be assessed like any other provider.
How Q-AUDION helps
Q-AUDION runs on Android, iOS and Windows with the same protocols on every client, and the server can be installed on your own infrastructure.
Files and attachments encrypted end to end
Reports, photos, audio and video shared in a conversation are encrypted end to end with AES-256-GCM, and the server only routes ciphertext. Messages between two contacts use a post-quantum ratchet (ML-KEM-768 + X25519) with forward secrecy for each message.
Group calls for crisis units
Group calls are encrypted end to end on a media server that forwards only ciphertext. The group key is renewed every 30 minutes and at every change of participants.
Calls with people you can identify
Every call starts with a new ML-KEM-1024 + X25519 key. Experts, lawyers and intermediaries are verified by NFC pairing, proximity QR or a 60-digit safety number, and the app alerts the user if a voice shows signs of synthesis.
Administrators limited to their own scope
Organisations can have administrators limited to their own scope, for example an office or a group company, who invite users, block accounts, revoke devices and assign functions and limits. Access is protected with TOTP and passkeys.
Audit log and remote wipe
The server keeps a hash-chained audit log, and a lost device can be wiped remotely with a signed command that the device verifies.
Designed to support customers' compliance with DORA and NIS2
DORA (Regulation (EU) 2022/2554) applies to insurance and reinsurance undertakings and to insurance intermediaries, and governs their ICT risk management, including ICT third-party providers. NIS2 (Directive (EU) 2022/2555) sets cybersecurity risk-management measures for the entities in its scope. Q-AUDION is designed to support your compliance with both for the communications it carries.
Among the cybersecurity risk-management measures, Directive (EU) 2022/2555 lists, where appropriate, the use of secured voice, video and text communications and secured emergency communication systems within the entity.
Directive (EU) 2022/2555 (NIS2), Article 21(2)(j)
Data and infrastructure in the EU
Production nodes are in Italy and Finland, and no third-party TURN or media service is used. GDPR functions include signed export of account data, account deletion, phone numbers stored only as hashes and configurable retention.
Three ways to install Q-AUDION, under your control
Choose where the service runs and who operates it. Functions and protocols are the same in all three.
Dedicated EU cloud, managed by BCrypto
Operated by: BCrypto
A dedicated instance in a European Union cloud, installed and operated by BCrypto. No infrastructure for you to maintain.
Dedicated server in your data centre, managed by BCrypto
Operated by: BCrypto
A virtual or physical server in the customer's data centre, with keys, domain and apps dedicated to your organisation, operated by BCrypto.
Installed at your premises, self-managed
Operated by: The customer
Installation on your own infrastructure and independent management, with training and support from BCrypto.
Customer-held KMS: if the server is installed at the customer's site, the root key stays in the customer's infrastructure.
Services
Installation and configuration
Setting up and configuring the service for your organisation.
Operations
Updates and maintenance of the service in the models managed by BCrypto.
Training
Courses for console administrators and for app users.
Support
Technical assistance from the BCrypto team in all three models.
Try Q-AUDION in your organisation
We will send you an invitation to try Q-AUDION. For your CISO and compliance team we can also arrange a confidential technical briefing on architecture, installation models and documentation.
A summary for banks, insurers and energy companies: security, deployment models and services.
Get the Enterprise BriefCompliance documentation (DPA, DORA addendum, supplier data sheet, exit plan, SBOM and vulnerability disclosure policy) is available on request through our contact form. Request the documentation