Socotra
Socotra sells a cloud native core insurance platform covering policy administration, billing, rating, document generation and underwriting and operations workbenches, and it competes on architecture rather than on installed base. The design premise is that policy administration is an operating system, and the product is built to that idea: a product agnostic data model, publicly documented open application programming interfaces, modules that can be added, removed or swapped, a marketplace of connected applications, and a single version on which every customer runs, upgraded automatically with no downtime. That last choice is the commercially consequential one, because it means a capability released to one customer is available to all of them at once.
The AI work arrived in two named steps. Agentic Configuration launched in October 2025, letting business teams configure and deploy insurance products through natural language rather than code, with claimed effects of halving configuration timelines, reducing development costs by 75 percent and shortening prototype iteration cycles by 90 percent. Socotra Assistant reached general availability on 11 March 2026. It is an underwriting capability embedded in the Operations Workbench that performs intelligent document import, risk assessment insights and automated summaries against live policy and billing data. It supports all products and geographies and is stated to be configurable in one week without coding. The company also publishes a Model Context Protocol server for connecting external agents to the platform, documented for setup against named commercial AI tools.
Two governance commitments are published as design principles rather than aspirations, and both are specific. The assistant makes changes or takes actions only with explicit human approval. The model does not learn from an insurer's secure data, and instead learns that insurer's own risk assessment criteria and product workflows.
Security disclosure is substantive. The company publishes ISO 27001 certification with its scope stated, a SOC 1 Type II assessment, and GDPR and HIPAA compliance positions. Data is encrypted at rest and in transit with customer specific keys, and penetration testing is regular. Each customer runs in a fully independent production environment. A data processing agreement is published, and an audit log of every configuration change and customer data operation is exposed through an event stream.
Scale is the weak side. The company reports more than 70 product launches and 15 migrations for insurers globally across property and casualty and life markets, an order of magnitude below the incumbent core platforms. Founded in 2014 and headquartered in San Francisco, California, the company is privately held, with roughly $50 million raised and investors including Insight Partners.
Capability Axes
Capability grades
15 of 15 axes rated · 7 graded A or B
Policy administration, billing, rating and document generation keep running with the models removed, since that is what carriers migrate onto. An underwriting assistant generally available since March 2026 and natural language product configuration change how the platform is used, not what it is.
Changes and actions happen only with explicit human approval, a constraint stated at action level on live policy and billing data. What the assistant may draft or stage beforehand, whether approval works in bulk and what an approver sees are not described.
Transparent reasoning is claimed, but a log of what happened is not an account of why the model produced it. Validation method, accuracy for document import and drift monitoring are unpublished, and how each carrier's adapted variant is tested before live use is never described.
More than 70 product launches and 15 migrations are stated without dates or customer names. Halved configuration timelines, 75 percent lower development costs and 90 percent shorter prototype cycles carry no baseline, attestation or period.
The model does not learn from an insurer's secure data, only from that insurer's own risk criteria and workflows, which rules out improving a shared model on one carrier's book. The commitment sits in release material rather than terms, and where inference runs is unstated.
A data processing agreement sets out handling procedures, and data ownership is defined explicitly in the terms, alongside GDPR and HIPAA compliance positions. Retention, subprocessors and region by region storage are not published.
ISO 27001 is held with its scope published, alongside 256 bit encryption with per customer keys, automated secrets management and regular penetration testing. The SOC report cited is a SOC 1, aimed at financial reporting controls rather than security.
Rate, rule and form filing support is not described, and no position is taken on the EU AI Act despite sales into life insurance, where risk assessment is high risk. The company holds no insurance license, as expected for a core supplier.
An underwriting assistant producing risk insights on live applications works where proxy variables do harm, and learning each insurer's criteria means inheriting whatever bias they hold. Bias testing, fairness metrics and model cards are absent from published material.
Every approval is recorded with a named person and moment, exposed to the carrier through an event stream, so an outcome can be traced to whoever approved it. Liability between vendor and carrier for a wrong summary is unallocated, and an applicant priced on an assisted assessment has no notice or route to contest.
A published Model Context Protocol server documents which external agents can reach core data and how. The model behind the vendor's own underwriting assistant is never named, leaving concentration risk and inference location unknown.
Open application programming interfaces, swappable modules and common programming languages let a carrier's own engineers extend the core, and one property and casualty insurer self implemented a product in five months. Policy, billing, rating and workbenches are covered, but claims is not part of the published estate.
Each production customer gets a fully independent environment with its own data and configuration, and every customer runs one version upgraded automatically without downtime. Region list, processing location choice and any private or on premises path are unpublished.
Pricing is absent, and the total cost of ownership advantage claimed against the market is unquantified. Analyst directory content describes a subscription priced by usage and modules, which is third party description rather than a published rate.
Any line, geography and distribution model is claimed through a product agnostic data model, with deployments in both property and casualty and life. Carriers replacing or augmenting a legacy core are both addressed, though the customer base behind those segments is thin.
Product updates
Material product, regulatory, evidence and commercial changes at Socotra, each verified against a live source and tagged to the capability axis it bears on. Funding rounds and awards are not product changes and are not logged.
Socotra's 7 October release removes the deprecated extended query parameter from all list endpoints, 57 endpoints across eight services led by Billing and Policies, leaving ListPageResponse as the only response shape. It also adds Labels for categorizing tasks in the Operations Workbench, configured per tenant (up to 100, and fixed once deployed) and applied from the Task Dashboard or through the Add Task and Update Task APIs, and it retires the Past Due status, moving those tasks to Active.
Socotra released Configuration Assistant, an AI agent inside Configuration Studio that creates, updates and visualizes insurance product configurations from natural language prompts, up to 3 uploaded requirement files (such as a filing) or an existing tenant configuration. It proposes a plan the user must confirm, shows the product as canvas and explorer views with plain language plugin code summaries, retries failed validation up to 5 times, and deploys to a new tenant or an existing test tenant.
Socotra published Socotra Skills, an open source set of reusable instructions and workflows that let external coding agents such as Claude Code, Codex and Cursor operate against the platform. The skills cover configuring billing, reporting and integrations, and calling Socotra's APIs to execute insurance workflows.
Compared With
Most editorial comparisons pair two vendors the index assesses as direct competitors for the same buyer. Some pair vendors that are adjacent rather than rival, where the useful question is where one ends and the other begins. Each carries a verdict, the buyer conditions that favor each vendor, and a graded side by side.
Alternatives to Socotra
Vendors in the same categories as Socotra whose profiles look most alike, each with a line on what the product does. Similar is not the same: check that each one does the job you need. No vendor pays for placement.
INSTANDA sells a no code policy administration and digital distribution platform to carriers, managing general agents and brokers, and its franchise is product configuration rather than analytics.
Duck Creek sells an enterprise core platform that property and casualty insurers run on, and it has built an agentic layer on top of that position.
FINEOS sells core insurance software to life, accident and health insurers and the employee benefits market.
Root Platform sells an API first core for digital and embedded insurance, used by insurers, managing general agents and the retailers, banks and telecoms that distribute cover.
BriteCore sells a cloud native core platform for property and casualty insurance to mid size carriers and fast growing managing general agents in North America.
Feathery automates the paperwork that moves between clients, brokers, advisers and carriers.
The index publishes no overall score or ranking. See what we assess and the methodology.
Pricing
Vendor-published figures are labeled as such. Figures labeled “Estimated” are derived from third-party sources and have not been confirmed by the vendor.
| Entry Price | Pricing Basis | Data Protection Terms | Implementation | Source |
|---|---|---|---|---|
|
Not published. No price, unit of billing, tier or contract term appears on any vendor surface for the platform, the underwriting assistant or the agentic configuration capability
|
Not published on any vendor surface. The platform spans policy administration, billing, rating, document generation and underwriting and operations workbenches, with an underwriting assistant and an agentic configuration capability layered above, and nothing published indicates whether charging follows premium under management, policies in force, transactions, modules, seats or a platform subscription. Independent analyst directory content indicates usage and module selection as the determining factors and names tiers as available, without stating the units. The modular design, under which components can be added, removed or swapped through open interfaces, indicates commercial packaging by module without describing the basis, and no marketplace pricing is published for applications that connect through it. | No tiered data protection terms are published. The underlying commitments are made at platform level rather than sold by tier. What is published is specific. A data processing agreement sets out technical and operating procedures for handling customer data, and the terms and conditions define data ownership explicitly. GDPR and HIPAA compliance positions are stated. Each customer gets a completely independent production environment with customer specific private keys, and an audit log of every configuration change and customer data operation is exposed to the customer through an event stream. The AI specific commitment is stated in release material rather than in contract terms. The model does not learn from an insurer's secure data and instead learns that insurer's own risk assessment criteria and product workflows. No retention schedule, subprocessor list or region list is published. | No implementation, configuration or professional services fee is published, and the product's commercial argument targets exactly this cost line. Configuration is positioned as achievable without customization or specialist training. Common programming languages and open interfaces let a carrier's existing engineers do the work. The agentic configuration capability lets business teams build product configurations from natural language, with claimed reductions of half on configuration timelines, 75 percent on development costs and 90 percent on prototype iteration cycles. One customer implementation supports the direction of that claim, not the magnitude. A property and casualty insurer self implemented a product in five months without the vendor doing the work. The underwriting assistant is stated to be set up in one week with no coding, the only implementation duration published for any component. None of it is priced, and no professional services rate card exists. No implementation timeline for a full core migration is published, despite the 15 migrations the company reports. | Vendor Published |
No price, unit or tier is published. The company's site and newsroom, its security and technology pages, and third party coverage all leave the number out. Independent analyst directory content describes a subscription with cost determined by usage and chosen modules, and with tiers available. That is third party description rather than vendor publication, and it is the only structural detail available.
The company is privately held, founded in 2014, with roughly $50 million raised and investors including Insight Partners, so no financial reporting fills the gap. Two published architectural facts bear directly on lifetime cost even without a figure. All customers run a single version upgraded automatically with no downtime, which removes the version upgrade project that dominates ownership cost at the incumbent end of the market.
Modules can also be added, removed or swapped through open interfaces. It is not stated whether the underwriting assistant is charged separately or included for all customers, given the company's stated position that keeping every customer current makes new capabilities available to all. Nor is it stated whether the agentic configuration capability and the protocol server carry their own commercial terms.