Industries: insurance

IT services for insurance firms in New Zealand

An insurance broker or adviser holds clients’ financial details, health disclosures and claims histories, and answers to the Financial Markets Authority, the Privacy Act 2020 and, for many firms, the AML/CFT Act for how they are handled. We run the IT, the security controls and the documentation for insurance firms of 20 to 200 staff, so advisers can work with clients and the compliance officer can show the firm’s obligations are met.

Book the 15-Minute Founder Call

Or call 0800 242 206

The IT problems a growing insurance firm runs into

A brokerage or advice firm that adds advisers, opens a second office or moves to a new client management platform is not only facing a technology problem. It is a client data problem, a regulator problem and an adviser experience problem at the same time. If any of the following sounds familiar, this page is for you:

Your current provider is slow to respond, and an adviser in a client meeting cannot wait for a callback.
Client disclosures and claims documents live in more places than your privacy statement says they do, including personal email and home computers.
Your own cyber insurance questionnaire was answered from memory, and a firm that sells the cover would struggle to prove its own answers.
Nobody can say with confidence which staff can see which client files, or whether a departed adviser’s access was revoked the day they left.
Support tickets disappear into a black hole, and your team has learned to live with it.

These are the problems we solve. The assessment further down this page is where we start.

What working with OxygenIT looks like

Managed IT and helpdesk

Monitoring, patching and a New Zealand team that answers your support line, 0800 101 095, in under 11 seconds on average during staffed hours. No call centre and no ticket black hole. We respond to P1 critical issues within 15 minutes during New Zealand business hours. The full response and resolution targets are on the published SLA. After-hours cover is a paid add-on delivered by our team in the United Kingdom, and early morning before 8.00am is uncovered.

Cyber security

The six controls insurers ask about, and that an insurance firm is expected to have itself: multi-factor authentication, endpoint detection and response, patch management, email security, DNS filtering and tested backups. Set up as the default for every login and every device, including the directors’ laptops. A virtual Chief Security Officer report sets out where the firm stands and what to fix first. See cyber security services.

Microsoft 365 and cloud

Setup, migration, backup and disaster recovery for the platforms the firm runs on, with cloud infrastructure that grows with the firm and client records kept where your privacy statement says they are.

Client management software support

We work with the client management, quoting and claims platforms New Zealand insurance firms use day to day. Supporting the software your firm runs on is part of the helpdesk, not a separate engagement, so there is one number to call when a client file will not open.

Adviser onboarding and offboarding

A single device standard, with each new adviser’s laptop imaged, secured and ready before their first day, and a documented offboarding step that revokes access to every client system the day someone leaves.

Strategy when you need it

Fractional virtual CIO and virtual CSO input for firms that need a technology roadmap and a security owner, not only a helpdesk. Whether you have 50 endpoints or 200, the same bands and the same targets apply. See managed IT services.

The FMA, the Privacy Act 2020 and the AML/CFT Act

Insurance firms are regulated on several fronts at once. Firms that give financial advice are licensed and supervised by the Financial Markets Authority. The Privacy Act 2020 applies to everyone, and the health and financial information an insurance file holds is the kind a breach does the most harm with. Many firms also carry obligations under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009. Three of those obligations land directly on your IT:

Storage and security. Client disclosures, claims documents and financial details must be protected against loss, unauthorised access, use, modification or disclosure. In practice that is multi-factor authentication on every login, encrypted devices, tested backups and an audit trail of who accessed what.
Records and retention. Advice records, client files and any AML/CFT due diligence records must be kept for the periods the rules set, and be retrievable when the FMA, an insurer or a client asks. You have to know every system they live in.
Breach notification. The Privacy Act 2020 requires a privacy breach likely to cause serious harm to be notified to the Office of the Privacy Commissioner and the people affected. Every firm we support has a documented breach response plan, not only a backup.

We are an IT provider, not a compliance adviser. We build and document the controls the rules expect. Your directors and your compliance officer decide what the firm’s obligations are.

The cyber security and compliance risk assessment

If you saw your firm in the list at the top of this page, the assessment is the starting point. We take your actual cyber insurance policy wording and your FMA, privacy and AML/CFT obligations, and we check your firm against them, control by control. It is not a sales call with a checklist stapled to it.

What gets checked

The security controls your insurance questionnaire says you have, verified against what is actually configured.
Client data access and the audit trail that proves it.
Multi-factor authentication coverage across every staff login, including the directors.
Backup status, and whether those backups have actually been tested.
Patching, email security, DNS filtering and endpoint protection.
Where client disclosures, claims documents and advice records live, and who can reach them.

What you get

A plain English report: compliant, at risk or non-compliant, control by control.
A prioritised fix list, so you know what to do first and what can wait.
Documentation you can put in front of your insurer at renewal and your auditor at review.

The assessment stands on its own. If your current provider has everything in order, you will have documented proof of it. If not, you will know exactly what to raise with them. The price is published on the cyber security audit cost guide.

Fully managed or co-managed

No two insurance firms are the same, and the service is shaped to fit. A brokerage with no IT staff and a larger firm that is struggling to keep an internal IT person need different things from us.

Fully managed IT. We take the whole environment: monitoring, patching, the helpdesk, security, backups and the roadmap. Priced in four bands by team size, and the band price is the price.
Co-managed IT. Your internal IT person keeps the roadmap and the relationship with the directors. We take the patching, the helpdesk overflow, the after-hours cover and the specialist security work. If you are struggling to retain IT staff, this is the gap it fills. See co-managed IT services.
Security on its own. Regular audits, continuous threat detection and a named virtual Chief Security Officer, alongside the IT provider you already have.

Why insurance firms choose OxygenIT

Published response targets. We respond to P1 critical issues within 15 minutes during New Zealand business hours, with a 2 hour resolution target. The targets are in the contract and reported on monthly.
A certified security practice. Independently certified to ISO/IEC 27001:2022 for information security and ISO/IEC 42001:2023 for AI management (as at May 2026), audited annually. The same controls we advise on, applied to ourselves.
A New Zealand team. Engineers in Auckland, Wellington and Christchurch, supporting firms across the country since 2005. Most work is delivered remotely, with on-site work where it is needed.
Clients who stay. 98% client retention rate (Canterbury clients, 2022 to 2025).
Sized for 20 to 200 staff. From a single-office brokerage to a multi-office advice firm. The managed IT bands are priced by team size, and every price is on the pricing page.

Other industries we publish a page for are on the industries hub.

Insurance IT support, common questions

What IT compliance requirements do New Zealand insurance firms face?

Financial Markets Authority licensing and supervision for firms that give financial advice, the Privacy Act 2020 for every firm, and AML/CFT obligations for many. We provide the cyber security and compliance risk assessment and IT compliance support, and the documentation an insurer, an auditor or the FMA asks for.

How does OxygenIT protect sensitive insurance client data?

Multi-factor authentication on every login, device encryption, endpoint detection and response, email protection, tested backups and, for firms that want it, continuous security monitoring. The virtual Chief Security Officer service gives the firm a named security owner.

Can your IT services scale as our firm grows?

Yes. We support organisations from 20 to 200 staff, with cloud infrastructure and managed environments that grow with the firm without a capital project at each step. Managed IT is priced in four bands by team size, so the price moves when the band does.

How quickly does OxygenIT respond to IT issues?

We respond to P1 critical issues within 15 minutes during New Zealand business hours, 8.00am to 5.00pm Monday to Friday, with a 2 hour resolution target. The support line, 0800 101 095, is answered in under 11 seconds on average. After-hours cover is a paid add-on delivered by our team in the United Kingdom.

Do you offer managed or co-managed IT for insurance firms?

Both. Fully managed IT covers the whole environment. Co-managed IT sits alongside your existing IT person and takes the patching, the helpdesk overflow, the after-hours cover and the specialist security and compliance work.

How is OxygenIT different from other IT companies?

We publish our numbers. Support calls on 0800 101 095 answered in under 11 seconds on average, a response to P1 critical issues within 15 minutes during New Zealand business hours, a 98% client retention rate (Canterbury clients, 2022 to 2025), and ISO/IEC 27001:2022 and ISO/IEC 42001:2023 certification (as at May 2026), audited independently every year. Few New Zealand providers publish even one of those.

Fifteen minutes with the founder

Tim Clarkson founded OxygenIT in 2005. The first call is 15 minutes, with him, to work out whether we are the right fit for your firm. Bring your own cyber insurance questionnaire and the question that worries you most. If we are not the right fit, he will say so.