generated: '2026-07-25'
method: searched
source: >-
  https://www.rsainsurance.co.uk/regulation/,
  https://www.rsainsurance.co.uk/brokers-and-partners/tools-resources/,
  https://www.polaris.co.uk/products/imarket/
summary: >-
  RSA Insurance publishes no machine-readable contract, so every API-shaped
  standard below is recorded as not conforming on evidence of absence rather
  than on a negative claim by the provider. What RSA does publish is financial
  regulatory posture: it is an authorised and regulated UK insurer, and it
  publishes the statutory disclosures a UK carrier must publish. In the UK
  intermediated market the data-exchange seam is Polaris Standards via the
  imarket hub and the broker software houses, not ACORD — and RSA documents
  none of that publicly.
standards:
- id: openapi
  conforms: false
  evidence: >-
    No OpenAPI or Swagger document on any RSA or Intact Insurance UK host.
    /openapi.json, /swagger.json, /api-docs probed on www.rsainsurance.co.uk,
    www.intactinsurance.co.uk, www.rsaonline.rsagroup.com (404) and
    www.connect.intactinsurance.co.uk (HTTP 200 catch-all error page, not a spec).
- id: asyncapi
  conforms: false
  evidence: No event catalog, webhook documentation or AsyncAPI document found.
- id: graphql
  conforms: false
  evidence: No /graphql surface found on any RSA host.
- id: grpc
  conforms: false
  evidence: No published .proto definitions found.
- id: oauth2
  conforms: false
  evidence: >-
    No OAuth 2.0 anywhere. /.well-known/oauth-authorization-server returns 404
    on every host that serves real content. Access is User ID + password to web
    portals.
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 (or a catch-all error page) on every host.
- id: rfc9116-security-txt
  conforms: false
  evidence: No /.well-known/security.txt served on any host.
- id: rfc9457-problem-details
  conforms: false
  evidence: No API, therefore no error envelope.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No API versioning or deprecation headers to observe.
- id: acord
  conforms: false
  evidence: >-
    No mention of ACORD, AL3, ACORD XML, NGDS or IVANS appears anywhere on
    rsainsurance.co.uk or intactinsurance.co.uk. This is the UK norm — ACORD is
    the North American seam.
- id: polaris-standards
  conforms: unknown
  evidence: >-
    The Polaris imarket commercial e-trading hub lists Intact among its
    participating insurers alongside Allianz, Arch, AXA, Aviva, NIG, QBE and
    Zurich, and lists Acturis, Applied, Bravo Digital Trader, Open GI and SSP as
    connected broker systems. Participation implies conformance to Polaris
    Standards, but RSA publishes no statement of it and Polaris publishes no
    public specification, so this is recorded as unknown rather than true.
  source: https://www.polaris.co.uk/products/imarket/
- id: lloyds-blueprint-two
  conforms: false
  evidence: >-
    No evidence RSA operates a Lloyd's syndicate or participates in PPL,
    Whitespace, DDM/DCOM or Blueprint Two. RSA is a company-market carrier
    writing on its own paper. Recorded as not found rather than absent — those
    platforms are themselves gated.
- id: mid-motor-insurance-database
  conforms: true
  evidence: >-
    RSA operates a MID2 Motor Insurance Database upload portal at
    services1.rsagroup.co.uk for registered intermediaries — participation in
    the UK statutory motor insurance data scheme. Web portal, not an API.
- id: elto-employers-liability-tracing
  conforms: true
  evidence: >-
    RSA publishes an Employers' Liability Register and an ELTO page
    (https://www.rsainsurance.co.uk/employers-liability-register/,
    https://www.rsainsurance.co.uk/elto/) — the FCA-mandated Employers'
    Liability Tracing Office disclosure.
regulatory:
- regime: UK PRA / FCA authorisation
  status: authorised
  detail: >-
    "Intact Insurance UK Limited (No. 00093792). Registered in England and Wales
    at 22 Bishopsgate, London, EC2N 4BQ. Authorised by the Prudential Regulation
    Authority and regulated by the Financial Conduct Authority and the Prudential
    Regulation Authority (Financial Services Register No. 202323)."
  register_number: '202323'
  company_number: '00093792'
  source: https://www.rsainsurance.co.uk/regulation/
- regime: FCA PROD 4 / Insurance Distribution Directive
  status: referenced
  detail: Product governance disclosures published under PROD 4 and the IDD.
  source: https://www.rsainsurance.co.uk/regulation/
- regime: Solvency II SFCR
  status: published
  detail: RSA Insurance Group Limited Solvency and Financial Condition Report published annually.
  source: https://www.intactinsurance.co.uk/external-regulatory-reports
- regime: UK Modern Slavery Act
  status: published
  detail: Modern Slavery and Human Trafficking Statement 2024 published as PDF.
  source: https://static.rsagroup.com/rsa/investors/company-performance/modern-slavery-human-trafficking-statements/modern-slavery-and-human-trafficking-statement-2024.pdf
- regime: UK GDPR / Data Protection Act 2018
  status: published
  detail: Privacy notice and cookies policy published on both the legacy and successor sites.
  source: https://www.rsainsurance.co.uk/privacy-notice/
certifications: []
certifications_note: >-
  No SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP or CSA STAR certification is
  published. No trust centre exists — trust.intactinsurance.co.uk does not
  resolve. RSA's published compliance posture is financial-regulatory, not
  information-security certification.