DEV Community

Alex Kane
Alex Kane

Posted on

n8n for InsurTech SaaS Vendors: 5 Automations for NY DFS Cybersecurity 500, NAIC Market Conduct, FCRA Adverse Action, HIPAA Health Plans, and NY Reg 187

#n8n #automation #security #programming

TL;DR — NY DFS 23 NYCRR 500 72-hour cybersecurity notification clock starts at your system's awareness event, not when your compliance team opens the ticket. FCRA insurance adverse action 5-business-day clock starts when the algorithm scores the risk, not when a human reviews the output. NAIC market conduct exam discovery extends to cloud iPaaS audit logs. Five production-ready n8n workflows, full JSON, seven customer tiers.

Why InsurTech SaaS Has the Most Underestimated Compliance Stack in Financial Services

Insurance platforms sit at the intersection of state-by-state regulatory fragmentation, federal privacy requirements, and real-time risk decision pipelines that regulators are only beginning to examine for automation bias.

A single InsurTech platform processes:

  • 23 NYCRR 500 (NY DFS Cybersecurity) — 72-hour notification for cybersecurity events; 24-hour notification for ransom payments (2023 amendment); covered entities include any insurer licensed in NY
  • NAIC Market Conduct Exam — state DOI examination of claims handling, underwriting, and policy issuance practices; cloud automation logs are discoverable
  • FCRA §611 / §615 — adverse action notice within 5 business days for insurance decisions based on consumer reports; algorithmic scoring decisions qualify
  • NY Reg 187 (11 NYCRR 224) — best interest standard for life insurance and annuity recommendations; workflow-generated suitability analysis must meet the standard
  • HIPAA 45 CFR §164 — health insurers are covered entities; PHI in claims processing workflows requires BAA with every automation vendor
  • GLBA Safeguards Rule (FTC 16 CFR Part 314) — applies to insurance companies that are not HIPAA-covered; information security program requirement
  • ERISA §502 / §404 — self-insured employer health plan fiduciary obligations; claims routing automation implicates fiduciary duty

The problem: most InsurTech SaaS vendors route policy issuance, claims triage, adverse action notices, and fraud alerts through the same Zapier or Make scenarios that handle their marketing funnels. The DFS 72-hour clock starts when your automation system logs the security event — and that timestamp is in a vendor-controlled audit log.

Seven Customer Tiers

InsurTech platforms serve customers with vastly different regulatory exposures:

Tier Profile Key Obligations
LARGE_LIFE_HEALTH_INSURER Licensed in 20+ states, NY DFS regulated DFS 500 + NY Reg 187 + HIPAA + NAIC MCAS
PROPERTY_CASUALTY_INSURER P&C carrier, Prop 103 / prior approval states NAIC + CA DOI + GLBA + FCRA adverse action
INSURTECH_MGA Managing General Agent, binding authority E&O + NAIC + binding authority audit + state producer license
CLAIMS_MANAGEMENT_SAAS Claims TPA, HIPAA health claims FCRA + fraud reporting + HIPAA BAA + ERISA §502
ACTUARIAL_ANALYTICS_SAAS Predictive scoring, underwriting analytics NAIC market conduct + algorithmic fairness scrutiny + FCRA
INSURANCE_DISTRIBUTION_SAAS Producer platform, e-application State producer licensing + NAIC suitability + DFS 500
INSURTECH_STARTUP Seed/Series A, limited state licenses State licensing + NAIC + DFS 500 + FCRA basics

Compliance Flags 

{
  "NAIC_MARKET_CONDUCT_EXAM_SUBJECT": true,
  "NY_DFS_500_REGULATED": true,
  "NY_REG_187_BEST_INTEREST_APPLICABLE": false,
  "HIPAA_HEALTH_PLAN_COVERED_ENTITY": true,
  "FCRA_ADVERSE_ACTION_REQUIRED": true,
  "ERISA_SELF_INSURED_PLAN_FIDUCIARY": false,
  "GLBA_SAFEGUARDS_RULE_SUBJECT": true
}
Enter fullscreen mode Exit fullscreen mode

NY DFS 500 note: The 2023 Second Amendment to 23 NYCRR 500 tightened the cybersecurity notification requirements. §500.17(a) now requires notification within 72 hours of determining a cybersecurity event occurred — not 72 hours from initial discovery. For InsurTech SaaS platforms running automated policy issuance and claims workflows, the "determination" timestamp can be a log entry from a failed authentication event or anomalous API call pattern that your n8n workflow generated before any human was involved.

Workflow 1 — Tier-Segmented InsurTech Platform Onboarding Drip

Different tiers need different Day 0 content. A life health insurer needs DFS 500 technical controls checklist and HIPAA BAA scope review on Day 0. A claims TPA needs FCRA adverse action pipeline setup. A startup needs state licensing compliance calendar.

{
  "name": "InsurTech Customer Onboarding Drip — Tier-Segmented",
  "nodes": [
    {
      "name": "Webhook Trigger",
      "type": "n8n-nodes-base.webhook",
      "parameters": {
        "path": "insurtech-customer-onboarding",
        "httpMethod": "POST"
      }
    },
    {
      "name": "Detect Tier & Compliance Flags",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const d = $input.first().json;\nconst tier = d.tier || 'INSURTECH_STARTUP';\nconst flags = {\n  NAIC_MARKET_CONDUCT_EXAM_SUBJECT: true,\n  NY_DFS_500_REGULATED: ['LARGE_LIFE_HEALTH_INSURER','PROPERTY_CASUALTY_INSURER','INSURTECH_MGA','CLAIMS_MANAGEMENT_SAAS','ACTUARIAL_ANALYTICS_SAAS','INSURANCE_DISTRIBUTION_SAAS'].includes(tier),\n  NY_REG_187_BEST_INTEREST_APPLICABLE: ['LARGE_LIFE_HEALTH_INSURER','INSURANCE_DISTRIBUTION_SAAS'].includes(tier),\n  HIPAA_HEALTH_PLAN_COVERED_ENTITY: ['LARGE_LIFE_HEALTH_INSURER','CLAIMS_MANAGEMENT_SAAS'].includes(tier),\n  FCRA_ADVERSE_ACTION_REQUIRED: ['LARGE_LIFE_HEALTH_INSURER','PROPERTY_CASUALTY_INSURER','INSURTECH_MGA','CLAIMS_MANAGEMENT_SAAS','ACTUARIAL_ANALYTICS_SAAS'].includes(tier),\n  ERISA_SELF_INSURED_PLAN_FIDUCIARY: ['CLAIMS_MANAGEMENT_SAAS'].includes(tier),\n  GLBA_SAFEGUARDS_RULE_SUBJECT: true\n};\nreturn [{json: {...d, tier, compliance_flags: flags}}];"
      }
    },
    {
      "name": "Day 0 — Tier Welcome Email",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "operation": "send",
        "toList": "={{ $json.email }}",
        "subject": "Welcome to InsurTech Platform — Your {{ $json.tier }} Compliance Setup",
        "message": "={{ $json.compliance_flags.NY_DFS_500_REGULATED ? 'NY DFS 23 NYCRR 500: 72-hour cybersecurity notification setup + covered entity assessment' : '' }}\n={{ $json.compliance_flags.NY_REG_187_BEST_INTEREST_APPLICABLE ? 'NY Reg 187 best interest standard: suitability workflow documentation required' : '' }}\n={{ $json.compliance_flags.HIPAA_HEALTH_PLAN_COVERED_ENTITY ? 'HIPAA: BAA scope review for all automation vendors in PHI processing chain' : '' }}\n={{ $json.compliance_flags.FCRA_ADVERSE_ACTION_REQUIRED ? 'FCRA §615: 5-business-day adverse action notice pipeline setup' : '' }}\n={{ 'NAIC market conduct readiness: claims audit trail + underwriting documentation' }}"
      }
    },
    {"name": "Wait 3 Days", "type": "n8n-nodes-base.wait", "parameters": {"amount": 3, "unit": "days"}},
    {
      "name": "Day 4 — DFS 500 Technical Controls Checklist",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "operation": "send",
        "toList": "={{ $json.email }}",
        "subject": "Day 4 — NY DFS 500 Technical Controls & NAIC Market Conduct Readiness",
        "message": "DFS 500 §500.03 CISO designation + annual cybersecurity report (Feb 15). §500.05 penetration testing annual. §500.06 audit trail 5yr retention. §500.11 Third-Party Service Provider Security Policy — your n8n instance is in scope. NAIC: document claims handling workflow including all automation nodes."
      }
    },
    {"name": "Wait 4 Days", "type": "n8n-nodes-base.wait", "parameters": {"amount": 4, "unit": "days"}},
    {
      "name": "Day 8 — FCRA + HIPAA + ERISA Setup",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "operation": "send",
        "toList": "={{ $json.email }}",
        "subject": "Day 8 — FCRA Adverse Action Pipeline + HIPAA BAA Scope Review",
        "message": "FCRA §615: adverse action notice within 5 business days of decision. Clock starts at algorithm output, not human review. HIPAA: every vendor in PHI claims chain needs BAA. Review Zapier/Make ToS — most lack sufficient HIPAA BAA language. ERISA §404: claims routing implicates fiduciary duty — document decision logic."
      }
    }
  ]
}
Enter fullscreen mode Exit fullscreen mode

Workflow 2 — NAIC/DFS/HIPAA/FCRA Compliance Deadline Tracker

Twelve deadline types across the InsurTech compliance stack. The DFS 500 72-hour clock and the FCRA 5-business-day adverse action deadline are the two highest-risk automated process failures.

{
  "name": "InsurTech Compliance Deadline Tracker",
  "nodes": [
    {
      "name": "Daily 8AM Trigger",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {"rule": {"interval": [{"field": "cronExpression", "expression": "0 8 * * *"}]}}
    },
    {
      "name": "Load Deadlines from Sheets",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {"operation": "read", "sheetName": "insurtech_compliance_deadlines",
        "columns": {"value": {"deadline_type": "", "deadline_date": "", "owner_email": "", "customer_id": ""}}}
    },
    {
      "name": "Classify Urgency",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const today = new Date();\nreturn $input.all().map(item => {\n  const d = item.json;\n  const deadline = new Date(d.deadline_date);\n  const days = Math.ceil((deadline - today) / 86400000);\n  let status;\n  if (days < 0) { status = 'OVERDUE'; }\n  else if (days <= 3) { status = 'CRITICAL'; }\n  else if (days <= 14) { status = 'URGENT'; }\n  else if (days <= 30) { status = 'WARNING'; }\n  else if (days <= 60) { status = 'NOTICE'; }\n  else { status = 'OK'; }\n  const penalties = {\n    DFS_500_CYBERSECURITY_EVENT_72H: 'Civil monetary penalty + license action — 23 NYCRR §500.17(a)',\n    DFS_500_RANSOM_PAYMENT_24H: 'Civil penalty — 23 NYCRR §500.17(b) 2023 amendment',\n    DFS_500_ANNUAL_REPORT_FEB15: 'License action — 23 NYCRR §500.17(b) February 15',\n    DFS_500_PENTEST_ANNUAL: 'Exam finding — 23 NYCRR §500.05',\n    FCRA_INSURANCE_ADVERSE_ACTION_5_BIZDAY: '$100-$1,000/violation 15 USC §1681n — actual + punitive damages',\n    NAIC_MARKET_CONDUCT_ANNUAL_STATEMENT: 'DOI exam trigger — state insurance code',\n    HIPAA_BREACH_NOTIFICATION_60D: '$100-$50,000/violation HHS 45 CFR §164.404',\n    HIPAA_BUSINESS_ASSOCIATE_AGREEMENT: 'HIPAA violation — 45 CFR §164.502(e)',\n    NY_REG_187_SUITABILITY_ANNUAL_REVIEW: 'NY DFS enforcement — 11 NYCRR §224',\n    GLBA_SAFEGUARDS_PROGRAM_ANNUAL: 'FTC §5 UDAP — 16 CFR Part 314',\n    NAIC_HOLDING_COMPANY_ACT_FILING: 'State insurance code filing deadline',\n    ERISA_PLAN_FIDUCIARY_ANNUAL_REVIEW: 'DOL investigation trigger — ERISA §404'\n  };\n  const penalty_ref = penalties[d.deadline_type] || 'See compliance calendar';\n  return {json: {...d, days_remaining: days, status, penalty_ref}};\n}).filter(i => ['OVERDUE','CRITICAL','URGENT','WARNING','NOTICE'].includes(i.json.status));"
      }
    },
    {
      "name": "Slack #insurtech-compliance Alert",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#insurtech-compliance",
        "text": "={{ $json.status }}: {{ $json.deadline_type }} — {{ $json.days_remaining }}d remaining. Penalty: {{ $json.penalty_ref }}. Customer: {{ $json.customer_id }}"
      }
    },
    {
      "name": "Email Owner",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "operation": "send",
        "toList": "={{ $json.owner_email }}",
        "subject": "{{ $json.status }}: {{ $json.deadline_type }} — {{ $json.days_remaining }} days",
        "message": "Deadline: {{ $json.deadline_date }}\nPenalty exposure: {{ $json.penalty_ref }}\nCustomer: {{ $json.customer_id }}"
      }
    },
    {
      "name": "Log to Sheets",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "append",
        "sheetName": "compliance_alerts_log",
        "columns": {"value": {"ts": "={{ new Date().toISOString() }}", "deadline_type": "={{ $json.deadline_type }}", "status": "={{ $json.status }}", "days_remaining": "={{ $json.days_remaining }}"}}
      }
    }
  ]
}
Enter fullscreen mode Exit fullscreen mode

The 12 deadline types this workflow tracks:

Deadline Statute Clock Penalty
DFS cybersecurity event notification 23 NYCRR §500.17(a) 72 hours from determination License action + CMP
DFS ransom payment notification 23 NYCRR §500.17(b) 2023 amend. 24 hours Civil penalty
DFS annual cybersecurity report 23 NYCRR §500.17(b) February 15 License action
DFS penetration testing 23 NYCRR §500.05 Annual Exam finding
FCRA insurance adverse action notice 15 USC §1681n, §1681b(f) 5 business days from decision $100–$1,000/violation + punitive
NAIC market conduct annual statement State insurance code Annual (varies by state) DOI exam trigger
HIPAA breach notification 45 CFR §164.404 60 days from discovery $100–$50K/violation
HIPAA BAA — all vendors in PHI chain 45 CFR §164.502(e) Before processing PHI HIPAA violation
NY Reg 187 suitability review 11 NYCRR §224 Annual NY DFS enforcement
GLBA Safeguards annual program review FTC 16 CFR Part 314 Annual FTC §5 UDAP
NAIC Holding Company Act filing State insurance code Annual State insurance code
ERISA plan fiduciary annual review ERISA §404 Annual DOL investigation

Workflow 3 — InsurTech API Health Monitor

Five API endpoints that map to active compliance chains. When any of these fail silently, a regulator-visible clock may be ticking.

{
  "name": "InsurTech API Health Monitor",
  "nodes": [
    {
      "name": "Every 15 Minutes",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {"rule": {"interval": [{"field": "cronExpression", "expression": "*/15 * * * *"}]}}
    },
    {
      "name": "Check Policy Issuance API — NAIC Audit Chain",
      "type": "n8n-nodes-base.httpRequest",
      "parameters": {"url": "https://api.insurtech.com/health/policy-issuance", "method": "GET",
        "options": {"response": {"response": {"neverError": true}}}}
    },
    {
      "name": "Check Claims Processing API — FCRA + HIPAA Chain",
      "type": "n8n-nodes-base.httpRequest",
      "parameters": {"url": "https://api.insurtech.com/health/claims", "method": "GET",
        "options": {"response": {"response": {"neverError": true}}}}
    },
    {
      "name": "Check Adverse Action API — FCRA 5-Biz-Day Clock",
      "type": "n8n-nodes-base.httpRequest",
      "parameters": {"url": "https://api.insurtech.com/health/adverse-action", "method": "GET",
        "options": {"response": {"response": {"neverError": true}}}}
    },
    {
      "name": "Check Cybersecurity Event API — DFS 500 §500.17",
      "type": "n8n-nodes-base.httpRequest",
      "parameters": {"url": "https://api.insurtech.com/health/security-events", "method": "GET",
        "options": {"response": {"response": {"neverError": true}}}}
    },
    {
      "name": "Check Fraud Detection API — Mandatory Reporting",
      "type": "n8n-nodes-base.httpRequest",
      "parameters": {"url": "https://api.insurtech.com/health/fraud-detection", "method": "GET",
        "options": {"response": {"response": {"neverError": true}}}}
    },
    {
      "name": "Evaluate Health & Compliance Impact",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const endpoints = [\n  {name:'policy_issuance_api', compliance:'NAIC market conduct audit trail — claims and policy documentation', severity:'HIGH'},\n  {name:'claims_processing_api', compliance:'FCRA §615 adverse action 5-biz-day clock + HIPAA PHI chain', severity:'CRITICAL'},\n  {name:'adverse_action_api', compliance:'FCRA §615 insurance adverse action — 5 business days from decision', severity:'CRITICAL'},\n  {name:'security_event_api', compliance:'DFS 23 NYCRR §500.17 72-hour notification — determination timestamp', severity:'CRITICAL'},\n  {name:'fraud_detection_api', compliance:'State Insurance Fraud Bureau mandatory reporting — silent failure = unreported fraud', severity:'HIGH'}\n];\nreturn $input.all().map((item, i) => ({\n  json: {\n    ...item.json,\n    endpoint: endpoints[i].name,\n    compliance_chain: endpoints[i].compliance,\n    severity: item.json.statusCode >= 200 && item.json.statusCode < 300 ? 'OK' : endpoints[i].severity\n  }\n})).filter(i => i.json.severity !== 'OK');"
      }
    },
    {
      "name": "Alert Slack #insurtech-ops",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#insurtech-ops-critical",
        "text": "API DOWN [{{ $json.severity }}]: {{ $json.endpoint }} — compliance chain at risk: {{ $json.compliance_chain }}"
      }
    }
  ]
}
Enter fullscreen mode Exit fullscreen mode

Workflow 4 — Insurance Adverse Action & Cybersecurity Incident Pipeline

Eight event types. The DFS 500 cybersecurity event and FCRA adverse action failure are the two most common triggers for enforcement action in InsurTech platforms.

{
  "name": "InsurTech Compliance Incident Pipeline",
  "nodes": [
    {
      "name": "Webhook — insurtech_compliance_event",
      "type": "n8n-nodes-base.webhook",
      "parameters": {"path": "insurtech-compliance-incident", "httpMethod": "POST"}
    },
    {
      "name": "Classify Incident Type",
      "type": "n8n-nodes-base.switch",
      "parameters": {
        "dataType": "string",
        "value1": "={{ $json.event_type }}",
        "rules": {
          "rules": [
            {"value2": "DFS_500_CYBERSECURITY_EVENT_DETECTED", "outputKey": "dfs500"},
            {"value2": "DFS_500_RANSOM_PAYMENT_MADE", "outputKey": "ransom"},
            {"value2": "FCRA_INSURANCE_ADVERSE_ACTION_ISSUED", "outputKey": "fcra"},
            {"value2": "NAIC_MARKET_CONDUCT_EXAM_INITIATED", "outputKey": "naic"},
            {"value2": "HIPAA_BREACH_PHI_CLAIMS", "outputKey": "hipaa"},
            {"value2": "NY_REG_187_SUITABILITY_GAP", "outputKey": "reg187"},
            {"value2": "INSURANCE_FRAUD_SUSPECTED", "outputKey": "fraud"},
            {"value2": "ERISA_FIDUCIARY_CLAIMS_BREACH", "outputKey": "erisa"}
          ]
        }
      }
    },
    {
      "name": "DFS 500 — 72h Clock",
      "type": "n8n-nodes-base.code",
      "parameters": {"jsCode": "const d = $input.first().json;\nconst detectedAt = new Date(d.detection_timestamp || new Date());\nconst notifyDeadline = new Date(detectedAt.getTime() + 72*3600000);\nconst hoursRemaining = Math.max(0, (notifyDeadline - new Date()) / 3600000).toFixed(1);\nreturn [{json: {...d, notify_deadline: notifyDeadline.toISOString(), hours_remaining: hoursRemaining, statute: '23 NYCRR §500.17(a)', action: 'Notify NY DFS within 72h of determination. File notice at portal.dfs.ny.gov. Engage outside counsel immediately.'}}];"}
      }
    },
    {
      "name": "DFS Ransom — 24h Clock",
      "type": "n8n-nodes-base.code",
      "parameters": {"jsCode": "const d = $input.first().json;\nconst paidAt = new Date(d.payment_timestamp || new Date());\nconst deadline = new Date(paidAt.getTime() + 24*3600000);\nreturn [{json: {...d, notify_deadline: deadline.toISOString(), statute: '23 NYCRR §500.17(b) — 2023 Second Amendment', action: 'Notify DFS within 24h of ransom payment. This requirement is new as of November 2023.'}}];"}
      }
    },
    {
      "name": "FCRA — 5-Biz-Day Adverse Action Clock",
      "type": "n8n-nodes-base.code",
      "parameters": {"jsCode": "const d = $input.first().json;\nconst decisionAt = new Date(d.decision_timestamp || new Date());\nconst bizDaysToDeadline = 5;\nlet count = 0; let dt = new Date(decisionAt);\nwhile(count < bizDaysToDeadline) { dt.setDate(dt.getDate()+1); if(dt.getDay()!==0&&dt.getDay()!==6) count++; }\nreturn [{json: {...d, adverse_action_deadline: dt.toISOString(), statute: '15 USC §1681n, §1681b(f) FCRA', action: 'Send adverse action notice within 5 business days of insurance decision. Include: CRA name/address/phone, right to free report, right to dispute. Failure: $100-$1,000/violation + punitive damages.'}}];"}
      }
    },
    {
      "name": "HIPAA — PHI Claims Breach 60d Clock",
      "type": "n8n-nodes-base.code",
      "parameters": {"jsCode": "const d = $input.first().json;\nconst discoveredAt = new Date(d.discovery_timestamp || new Date());\nconst hhsDeadline = new Date(discoveredAt.getTime() + 60*86400000);\nreturn [{json: {...d, hhs_notification_deadline: hhsDeadline.toISOString(), statute: '45 CFR §164.404', action: 'Notify HHS within 60 days of discovery. If 500+ individuals in one state: also notify prominent media in that state. Review all BAAs in PHI processing chain.'}}];"}
      }
    },
    {
      "name": "Escalate — Slack #legal + Gmail CCO",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#legal-escalation",
        "text": "INSURTECH COMPLIANCE INCIDENT: {{ $json.event_type }}\nStatute: {{ $json.statute }}\nDeadline: {{ $json.notify_deadline || $json.adverse_action_deadline || $json.hhs_notification_deadline }}\nAction: {{ $json.action }}\nCustomer: {{ $json.customer_id }}"
      }
    },
    {
      "name": "Log to Sheets",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "append",
        "sheetName": "insurtech_compliance_incidents",
        "columns": {"value": {"ts": "={{ new Date().toISOString() }}", "event_type": "={{ $json.event_type }}", "statute": "={{ $json.statute }}", "customer_id": "={{ $json.customer_id }}"}}
      }
    }
  ]
}
Enter fullscreen mode Exit fullscreen mode

Workflow 5 — Weekly InsurTech KPI Dashboard

CEO + Chief Compliance Officer + Chief Actuary. Monday 8AM. Compliance exposure summary alongside premium and loss ratio metrics.

{
  "name": "Weekly InsurTech KPI Dashboard",
  "nodes": [
    {
      "name": "Monday 8AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {"rule": {"interval": [{"field": "cronExpression", "expression": "0 8 * * 1"}]}}
    },
    {
      "name": "Load Metrics",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const static_data = $getWorkflowStaticData('global');\nconst prev_gwp = static_data.last_gwp || 0;\nconst curr_gwp = $json.gross_written_premium || 0;\nconst gwp_wow = prev_gwp > 0 ? (((curr_gwp - prev_gwp) / prev_gwp) * 100).toFixed(1) : 'N/A';\nstatic_data.last_gwp = curr_gwp;\nreturn [{json: {...$json, gwp_wow_pct: gwp_wow}}];"
      }
    },
    {
      "name": "Build HTML Report",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const d = $input.first().json;\nconst html = `<h2>InsurTech Weekly KPI — ${new Date().toDateString()}</h2>\n<table border=1><tr><th>Metric</th><th>Value</th></tr>\n<tr><td>Gross Written Premium</td><td>$${d.gross_written_premium?.toLocaleString()}</td></tr>\n<tr><td>GWP WoW</td><td>${d.gwp_wow_pct}%</td></tr>\n<tr><td>Loss Ratio</td><td>${d.loss_ratio}%</td></tr>\n<tr><td>Accounts — Large Insurer</td><td>${d.large_insurer_accounts}</td></tr>\n<tr><td>Accounts — MGA</td><td>${d.mga_accounts}</td></tr>\n<tr><td>Accounts — Claims TPA</td><td>${d.claims_tpa_accounts}</td></tr>\n<tr><td>Open DFS 500 Events</td><td>${d.dfs500_open}</td></tr>\n<tr><td>Open FCRA Adverse Actions</td><td>${d.fcra_open}</td></tr>\n<tr><td>Open HIPAA Incidents</td><td>${d.hipaa_open}</td></tr>\n<tr><td>NAIC Exams In Progress</td><td>${d.naic_exams}</td></tr>\n<tr><td>Total Compliance Incidents</td><td>${d.total_incidents}</td></tr>\n</table>`;\nreturn [{json: {...d, html_report: html}}];"
      }
    },
    {
      "name": "Email CEO + BCC CCO + Chief Actuary",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "operation": "send",
        "toList": "={{ $json.ceo_email }}",
        "ccList": "={{ $json.cco_email }},{{ $json.chief_actuary_email }}",
        "subject": "InsurTech Weekly KPI — {{ new Date().toDateString() }}",
        "message": "={{ $json.html_report }}"
      }
    },
    {
      "name": "Post to Slack #exec-insurtech-kpis",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#exec-insurtech-kpis",
        "text": "Weekly KPI: GWP ${{ $json.gross_written_premium?.toLocaleString() }} ({{ $json.gwp_wow_pct }}% WoW) | Loss Ratio {{ $json.loss_ratio }}% | DFS 500 open: {{ $json.dfs500_open }} | FCRA: {{ $json.fcra_open }} | HIPAA: {{ $json.hipaa_open }}"
      }
    }
  ]
}
Enter fullscreen mode Exit fullscreen mode

The Cloud iPaaS Problem in InsurTech

Four specific reasons InsurTech SaaS vendors should run these workflows on self-hosted infrastructure:

1. NY DFS 500 §500.17 — the 72-hour clock and the determination problem
The 2023 Second Amendment changed "becoming aware" to "determining" that a cybersecurity event occurred. For InsurTech platforms running automated fraud detection and anomaly scoring, the "determination" timestamp can be a structured log entry from your automation workflow — before any human is involved. When your n8n workflow generates a CYBERSECURITY_EVENT_DETECTED node execution, that log entry may be the determination timestamp for DFS 500 purposes. If that log is in a cloud iPaaS vendor's infrastructure, you don't fully control it.

2. FCRA insurance adverse action — algorithmic decision timestamp
FCRA §615(a) requires adverse action notice within 5 business days when an insurance decision is based in whole or in part on a consumer report. The FTC's position is that the clock starts at the decision — when the algorithm outputs the adverse recommendation — not when a human underwriter reviews and approves it. When your underwriting scoring workflow runs through Zapier at 2 AM and flags a risk, the 5-business-day clock may have started before your compliance team opens their laptops.

3. NAIC market conduct exam discovery
State DOI market conduct examinations routinely request claims handling documentation, underwriting workflow records, and audit trails. Under NAIC guidelines, "records" include automated workflow execution logs. A market conduct examiner asking for your claims routing audit trail is entitled to the complete processing record — including the cloud iPaaS vendor logs that show every decision node. Self-hosted n8n gives you that record under your control.

4. HIPAA health plan BAA scope creep
Health insurers and claims TPAs are HIPAA covered entities. Every vendor in the PHI processing chain needs a Business Associate Agreement. Most enterprise iPaaS vendors (Zapier, Make, Tray.io) have HIPAA BAA offerings — but the BAA requires you to configure the service to handle PHI under specific terms. When a new automation developer adds a Gmail node to a claims processing workflow without reviewing the PHI handling configuration, you've potentially created an uncontrolled PHI processor. Self-hosted n8n keeps the PHI chain within your infrastructure where you already have a documented BAA perimeter.

Get the Complete InsurTech Automation Pack

All five workflows — onboarding drip, deadline tracker, API health monitor, incident pipeline, and KPI dashboard — are available as production-ready n8n JSON files in the FlowKit n8n Automation Bundle.

→ FlowKit on Gumroad | Individual templates $12–$29 | Full bundle $97

Part of the n8n Compliance Series — vertical-specific automation workflows for SaaS vendors operating under US and EU regulatory frameworks.

Previous: HR Tech/PEO SaaS | LogiTech/Supply Chain SaaS | CleanTech/EnergyTech SaaS

Top comments (0)