PrivaSearch
Book a demo

Insurance brokers and mortgage advice

AI for insurance and mortgage advice, within the GDPR. Finding coverage gaps without sharing client data.

PrivaSearch is software that lets your team search its own client files with Claude, ChatGPT or Mistral Vibe, after names, BSNs (Dutch citizen service numbers) and addresses have been replaced by pseudonyms and a colleague has checked that. For an insurance broker or mortgage adviser, that means: comparing policy conditions and querying client files, while income and health data do not reach the AI in recognisable form.

Book a demo
In short

A client file contains income, debts and sometimes health. In a chatbot, all of that goes along.

PrivaSearch replaces that data with pseudonyms and has a colleague release the document.

Policy conditions without personal data you compare just as well, with the passage.

What you use AI for

The client files that matter.

An adviser reads policy conditions next to client files. An assistant that can search both saves hours, if it does not need to know the client.

  1. Comparing policy conditions

    Putting exclusions, excesses and cover from different insurers side by side, with the provision and the page.

  2. Coverage gaps and risks

    Checking whether a client's policies together cover what they need, and where there is a gap.

  3. Mortgage files

    Searching income details, valuations and quotes, with names, BSNs (Dutch citizen service numbers) and IBANs replaced by pseudonyms.

  4. Claims and damage files

    Finding what was agreed or paid out for an earlier claim.

Which rules apply

What the law asks of your client files.

Anyone who advises on or mediates in insurance or mortgage credit works under the Wft. Health data also has a regime of its own in the UAVG.

The question we hear most often

Working GDPR-proof with AI at an insurance broker: what does that involve?

No tool does that for a firm, PrivaSearch included. The GDPR and the AI Act place the obligations with you as the controller. What your firm arranges itself, and what PrivaSearch does to help:

What your firm arranges itself

  • A lawful basis (Articles 6 and 9 GDPR)A lawful basis for every processing operation, and for special category data an exception from Article 9(2) as well.
  • A data processing agreement (Article 28 GDPR)With every party that processes data for you: with PrivaSearch, and with the provider of the AI assistant you connect.
  • A DPIA where one is required (Article 35 GDPR)Often with special category data or processing on a large scale.
  • An AI policyWhich tools are allowed, with which data, and who decides on that.
  • AI literacy (Article 4 AI Act)Staff who work with AI know what they are doing and what the risks are.
  • Professional secrecyThe duty of confidentiality for whoever processes health data (art. 30(4) UAVG). Per project, appoint only reviewers who fall under it.

What PrivaSearch does to help

  • Pseudonymising before the AINames, BSNs (Dutch citizen service numbers) and addresses are replaced before anything goes to your AI assistant.
  • A mandatory privacy reviewA colleague checks and approves every document. Only then is it searchable.
  • Permissions per projectOnly the members of a project see the documents of that project.
  • The activity logWho viewed, searched, released or revealed what, without document content in the log.
  • Storage in the EUOriginals are stored in data centres in the EU, in a database of its own per organisation.
  • An AI policy and a DPIA to start withStarter documents based on your own set-up, to have reviewed.

PrivaSearch is designed for the GDPR. The assessment of your situation remains yours and that of your data protection officer or lawyer.

How it works

From client file to answer, in four steps.

The AI only receives text that a colleague has released, with pseudonyms instead of names. See how it works.

  1. Add client files. Upload documents or connect a SharePoint library; SharePoint is only read.
  2. Detect and pseudonymise. A language model within PrivaSearch and Dutch patterns (BSN with the eleven test, IBAN, Dutch number plate, KvK number) find personal data and replace it with pseudonyms.
  3. A colleague reviews. Original and pseudonym are side by side. What the model missed, the reviewer adds; then they approve the document.
  4. Search with your assistant. Claude, ChatGPT Business or Mistral Vibe searches the released passages through a secure MCP connection, for example: “Is water damage from a leaking pipe covered in the policy conditions that [PERSOON_A4F2] has?”

The difference

A client file in a chatbot, or through PrivaSearch.

Topic WithoutUploading a client file to a chatbot WithPrivaSearch between your client file and your assistant
What the AI sees The entire client file, with names, BSNs and addresses. Released passages with pseudonyms.
Check beforehand None. A mandatory review by a colleague.
Who may see it Whoever uploads it, outside any arrangement for the client file. Only the members of the project.
What is recorded Nothing. Every view, search and release in the activity log.
Where the originals are With the provider of the chatbot. In data centres in the EU.

What you type into the assistant yourself goes straight to it, outside PrivaSearch. So ask about the role or the pseudonym, not about the person.

Frequently asked questions

What you probably want to know.

Working GDPR-proof with AI at an insurance broker: what does that involve?

No tool does that for you. Your firm arranges a lawful basis, a data processing agreement, a DPIA where one is required, an AI policy, AI literacy and professional secrecy itself. PrivaSearch does the technology: pseudonymising before the AI, a mandatory review, permissions per project, the activity log, storage in the EU and a starter document for your AI policy and your DPIA.

May I put a client file into ChatGPT to find a coverage gap?

The entire client file then goes to the provider, with income, debts and sometimes health. On a personal account there is no data processing agreement. With PrivaSearch, the assistant only sees released passages with pseudonyms.

Can I have policy conditions from different insurers compared?

Yes. Policy conditions themselves contain no client data. Put them in a project, and your assistant searches them with source references: which exclusion, which excess, on which page.

What happens to health data from a medical examination?

Detected data is replaced with pseudonyms, and a colleague checks that in the review. For you, it remains health data: record per project which exception applies and appoint only reviewers with a duty of confidentiality.

Does a mortgage adviser also fall under these rules?

Yes. Advice on mortgage credit falls under the Wft, and a mortgage file contains income, debt and identity data. The same approach applies: pseudonyms, review and permissions per project.

Does PrivaSearch make decisions about a client?

No. PrivaSearch helps you find what is already in your client files. The AI policy that PrivaSearch drafts prohibits using AI output as the basis for a decision about a person without your own substantive assessment.

Sources

The legislation and the pages of the supervisory authority were consulted on 3 November 2026. If you see something that is no longer correct, email us at privacy@privasearch.ai.

Read also

Updated on

See in twenty minutes what happens to your documents.

We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.

Book a demo →