Three Vendors Earn CSIO API Security Certification
AlStar Solutions, Logiciels Deltek Inc. and Trufla Technology now meet CSIO's common model for authentication and authorization.
Updated on Nov. 3, 2026 in Cybersecurity
AlStar Solutions, Logiciels Deltek Inc. and Trufla Technology achieved CSIO API Security Standards Certification, showing they apply the organization's common model for authentication and authorization. The certification comes as critical PHP vulnerabilities led organizations across several countries to take systems offline as a precaution.
Why it matters
APIs let broker management systems, insurer platforms and other tools exchange data, making shared technology an increasing source of cyber risk, according to the Insurance Bureau of Canada. CSIO is pushing for common security practices as the property and casualty industry moves toward real-time data exchange.
Three technology vendors earned CSIO API security certification, while four organizations earned eDocs certification earlier this month. The source does not state how many organizations were affected by the PHP vulnerabilities or how long systems remained offline.
The players
CSIO
The Canadian Standards Association-linked Insurance Industry standards body that publishes common technology standards for the property and casualty insurance sector and maintains a list of certified members.
Insurance Bureau of Canada
The national industry association representing Canada's private home, auto and business insurers, which publishes research on cyber insurance risk.
The details
The vendors earned certification by applying CSIO's common model for authentication and authorization when exchanging information with insurers and partners. CSIO's API security program sits alongside its eDocs certification, which standardizes how insurer documents are labelled in brokers' systems.
Timeline
Earlier this month, APRIL Canada, Maple Mutual, Yarmouth Mutual and SynthMind Technology earned eDocs certification.
This month, critical PHP vulnerabilities led organizations to take systems offline as a precaution.
November 2, 2026: Three vendors' API security certification was reported.
Big Picture
The API security certification extends CSIO's eDocs certification, which standardizes how insurer documents are labelled in brokers' systems, into the security of data exchange between those same systems. Together the two programs reflect CSIO's push for common practices as the property and casualty industry moves toward real-time data exchange.
Brokers and policyholders working with these vendors may see stronger authentication and authorization when insurance data moves between systems. Organizations running PHP-based systems should check whether their own platforms were among those taken offline or need patching.
The takeaway
Third-party software is now part of an insurer's and broker's own cyber risk, so checking the security certifications of the vendors in your data chain is worth doing. Common standards like CSIO's API certification make those checks easier to compare across providers.
Further reading
For more on how shared software creates risk, see Cybersecurity coverage.
Source note: This article includes information reported by Insurance Business.
