Infrastructure for licensed distributors
Prove what you quoted. Don’t ask anyone to take your word.
Article 20 of the IDD says you must be able to justify what you recommended. Every system that stores those records can also edit them, so a regulator cannot tell an accurate history from a corrected one. RiskRouter prices on the server and seals each quote into a chain where changing one entry breaks every entry after it — and hands you the evidence to keep.
You integrate it. We never touch your customer, never handle a claim, never hold the carrier relationship. And if we stop existing tomorrow, an export you already downloaded still verifies without us.
The problem it solves
The IDD requires a distributor to document what the customer needed and to justify what was proposed. A large network absorbs that cost in a compliance department. A practice of three people absorbs it in evenings, in spreadsheets, and in hoping the file is still findable in two years. RiskRouter is built for the second case.
Modular by design
Each vertical has one mandatory base layer and four optional modules. A customer builds the cover they want. The price changes as they do, and it changes on the server.
One request to price
Post a vertical and a set of toggles. Get back priced line items, a total, and the exact component state that was recorded. No SDK, no session, no state to manage.
Audit trail by default
Every quote is appended to a ledger built for IDD Article 20 traceability. The database refuses edits and deletions, for every role including the administrative one.
The rating matrix, published rather than described
Four sample verticals and twenty components ship with the validation build. They are worked
examples of what the engine can be configured to price — not products, not cover, and
not for sale to anyone. Your own rates replace them. The live matrix is served at
GET /api/v1/verticals, so an interface renders exactly what the engine charges
instead of a copy that drifts.
mobility
E-bike, scooter, car-share and on-demand fleet exposure.
base 2.00 / month5 components
digital_nomad
Cross-border remote work, client liability and device exposure.
base 1.50 / month5 components
urban_rental
Tenant liability, deposit liquidity and connected-home risk.
base 3.50 / month5 components
micro_travel
Short-haul multi-modal transit and seasonal sports exposure.
base 2.50 / month5 components
What happens to your evidence if we disappear
This is a one-person company. You should ask that question before you depend on us, and the answer should not rest on our goodwill on the day it matters.
You can take it all, any time
One authenticated call returns your entries in full, the digest skeleton of the whole chain they sit inside, and the signed head. No ticket, no notice period, no export fee.
It verifies with us switched off
Two standard-library Node scripts in a public repository check it offline. The signing
key stays in anchors/, including after a rotation, so an attestation you
saved years ago is still checkable against the key that made it.
Save one a month
A single export proves the chain is consistent. A series of them, saved on different dates, proves it was not rewritten — because a head you recorded in March is a number nobody can go back and change.
There is no SDK you must install and nothing to license. A product that is hard to leave has to be hard to leave, and we would rather build one that does not need to be. See exactly what an export contains.
What we refuse to do
Most of the engineering here went into the failure cases rather than the happy path. These are the decisions worth knowing before you integrate.
We never trust a price from a browser
The server computes every premium and discards anything the client sends. It forces the mandatory base layer back on if a modified request tries to strip it out.
We never report a write that did not happen
A ledger failure degrades the response rather than faking a success. If no audit record exists, the interface says so. Claiming otherwise is the failure an audit exists to catch.
Money never touches a float
Premiums stay in integer cents until they are formatted once, at the response boundary. Floating-point euros drift, and drift eventually gets rejected by the database.
The ledger protects itself
It refuses deletion, so a flood would be permanent. The table caps its own write rate, which holds even if the API in front of it is bypassed entirely.
Built for where it runs
only
Where this stands today
RiskRouter is running as a validation build. The routing path is real and every number on the demo comes from the live engine, but distribution is suspended: no cover is placed, no carrier is contracted and no payment instrument is touched. The regulatory position sets out exactly what is and is not in place.