Federato alternatives, and the question every listicle skips: who owns the alternative?

Federato sells what the industry has started calling an underwriting workbench. Submissions arrive as email, attachments, spreadsheets and broker portals; the platform reads them, structures them, scores them against the appetite the carrier or MGA has defined, and puts the ones worth working at the top of an underwriter's day. The pitch is not that a machine underwrites. It is that the underwriter stops spending the morning deciding what to open.

That is a real problem and it is worth money. The difficulty is that the category is close to unshoppable using the normal methods, for three reasons that compound.

The first is that almost nobody publishes a price, so a shortlist cannot be sorted on cost until every vendor has been through a sales cycle. The second is that the buyer is being asked to compare products that are not the same shape: a submission triage tool, a pricing and portfolio platform, a document extraction engine and an agent framework all appear on the same list under the same heading. The third is the one this page exists for. The list itself has been quietly reorganised by acquisition, and the published comparisons have not caught up. A buyer who shortlists Federato against Planck and Cytora believes they are looking at three independent companies. They are looking at Federato and two products belonging to Applied Systems.

None of that makes Federato the wrong choice. It makes the standard shortlist a bad instrument. What follows is the shortlist rebuilt around ownership and disclosure, which are the two things a mid-market underwriting operation can actually verify before it signs.

This is the part worth ten minutes of a management meeting, because it changes what the shortlist means rather than merely adding a fact to it.

Applied Systems acquired Planck. Planck's own homepage carries the badge "is now part of Applied Systems" and links to the release, dated July 23, 2024. Applied Systems also acquired Cytora, announced on Cytora's own blog on September 9, 2025, in its own words: "Insurtech Cytora announced that the company has been acquired by Applied Systems, a world leader in technology for the risk and insurance industry." So two vendors that appear as separate rows on every comparison table published before late 2025 now share a parent.

That parent is not a neutral party to a mid-market insurance operation. Applied Systems is the owner of Applied Epic and EZLynx, which between them are the agency management backbone for a very large share of the independent distribution channel. Applied's own Planck announcement described the deal as expanding its AI capability across a portfolio serving "both the agency and carrier sides of the market", and noted it had already released AI features in select Applied and EZLynx products. If your agency or MGA already runs on Applied software, then choosing Planck or Cytora is not diversification. It is a deeper commitment to a vendor you are already committed to, which may well be the right answer, but it should be a decision rather than an accident.

Duck Creek acquired Send. Send's own homepage carries it as current news in plain words: "Duck Creek has acquired Send to create the industry's only Agentic Underwriting-to-Core Platform." Duck Creek's release, dated July 7, 2026, states that Send will continue to operate as a standalone underwriting orchestration platform compatible with multiple core insurance systems. That commitment is worth having in writing in your own contract rather than in a press release, because the whole appeal of an orchestration layer is that it is not welded to one core.

And one alternative has changed its name. Roots Automation, the vendor behind InsurGPT, relaunched as Bevaya on May 28, 2026. We confirmed the redirect chain ourselves: rootsautomation.com returns a 301 to roots.ai, which returns a 301 to bevaya.ai. The legal entity is unchanged and the site footer says so, reading "Roots Automation, Inc. dba Bevaya". Anyone circulating a shortlist that says "Roots Automation" is circulating a document that predates May.

We looked for the same pattern on the rest and did not find it. Federato, hyperexponential, Kalepa, Convr and Indico Data carried no acquisition notice on their own sites when we read them on August 16, 2026. We are stating that as the absence of a finding rather than as a positive claim of independence, because a company is under no obligation to announce ownership on its homepage, and the honest version of this research is that we checked and saw nothing rather than that we proved a negative.

Every cell below was read on the vendor's own site or its own press release on August 16, 2026. The pricing column records the literal HTTP response we got from the vendor's pricing address, because in this category the status code is more informative than the page.

The column that should stop a reader is the third one. Ten vendors, one published price. Six return a 404 at the address a buyer would type first, two redirect to the homepage, and one has no pricing page to return anything. That is not a coincidence of web maintenance, it is a category norm, and it has a consequence: the only way to sort this shortlist on cost is to enter nine sales processes.

Bevaya's pricing page loads normally and states the rate in its own words: each AI agent is four thousand dollars a month and adds one hundred thousand credits to a shared balance, billed annually. Multiple agents attract a discount, five percent at two agents, ten percent at three, up to twenty percent above that, and the page shows a worked three agent example at ten thousand eight hundred dollars a month. Consumption sits on top as credit tiers named Starter, Growth, Scale and Enterprise, with volume discounts rising to fifteen percent before it asks you to contact sales.

We are reporting that as a credit to Bevaya. In a category where nine of ten vendors make you book a call to learn the shape of the model, publishing the unit and the rate is genuinely useful, and it is the sort of behaviour a buyer should reward.

It also lets you do arithmetic no other vendor here permits. One agent is forty eight thousand dollars a year before any consumption above the included credits. Three agents is roughly one hundred and twenty nine thousand a year at the published discount. For an operation doing eight to fifty million in revenue, that is not a software line item, it is a hire, and it should be compared against one. The honest framing is not whether forty eight thousand is expensive in the abstract. It is whether the work you would point that agent at is worth more than the person you would otherwise hire to do it, and whether the volume is steady enough to keep the agent busy in the months that are not renewal season.

One caution on reading that page. It carries a headline reading "starting as low as 0 dollars per AI agent per month" directly above the four thousand dollar rate, which appears to be the resting state of an interactive calculator rather than an offer. Do not quote the zero into a board paper. Quote the four thousand, and ask them to confirm it in writing against your expected credit consumption, because the consumption half is where a published unit price stops being a predictable bill.

Every quantified outcome in this section is the vendor's own published claim, reproduced as a claim. None of them carried a footnote, a sample size, a baseline or a period on the pages where we found them, so none of them should be treated as a benchmark. We say that once here rather than repeating it ten times.

01. Bevaya, formerly Roots Automation. An agent platform aimed at claims and servicing work rather than at risk selection, built on what the company calls InsurGPT, which its own relaunch release describes as an ensemble of specialised models trained on more than three hundred million proprietary insurance documents. Where it wins: it publishes a price, it names its integrations concretely rather than as a logo wall, listing Guidewire, Duck Creek, OnBase, Outlook, SFTP and custom APIs on the pricing page itself, and its security page is the most specific of the ten, citing SOC 2 Type 2 attestation audited annually, HIPAA, GDPR, CCPA, the New York cybersecurity regulation at 23 NYCRR 500, annual penetration testing and quarterly access reviews. Where it costs you: the customer language is unambiguously enterprise, claiming three of the five largest US P&C carriers, three of the top ten brokers and three of the top twenty TPAs, and a vendor whose reference accounts are that size is not organised around a fifteen person underwriting team. Diligence note: its security page says customer data is never shared with another customer and never appears in another customer's output, which addresses cross-customer leakage. It is not the same statement as saying your documents will not train the shared model, and we did not find that second statement anywhere public. Ask for it.

02. Cytora, an Applied Systems company. Risk digitisation: turning the submission and its attachments into structured, decision-ready data at the front of the pipeline. Where it wins: it is the most clearly specialised product of the group at the intake step, and its published customer claims are attached to named insurers rather than to anonymous composites, which is a higher standard of sourcing than most of this list. Where it costs you: the ownership. Diligence note: if you run Applied Epic or EZLynx, this is the same corporate relationship, and the questions to ask are about roadmap priority and exit terms rather than about the technology.

03. Planck, an Applied Systems company. Generative AI applied to commercial underwriting data, principally enriching a risk from outside sources rather than orchestrating the workflow. Where it wins: data enrichment is the piece of this problem least worth building yourself, because the value is in the acquisition and maintenance of the underlying sources. Where it costs you: same parent as Cytora, so shortlisting both is shortlisting one company twice. Diligence note: Applied's own acquisition announcement framed the plan as extending these capabilities across its portfolio on both the agency and carrier sides, so ask where a standalone Planck contract sits in that plan.

04. Send, a Duck Creek company. An underwriting workbench for commercial and specialty insurers, MGAs and program administrators, and the closest structural comparison to Federato on this list. Where it wins: orchestration is what it does, rather than being a feature attached to something else, and it publishes real scale, claiming more than twenty six billion in gross written premium through the platform. Where it costs you: it now belongs to a core systems vendor, which is precisely the dependency an orchestration layer is bought to avoid. Diligence note: Duck Creek's release says Send stays compatible with multiple core systems. Get that into the contract as a term with a remedy, not as a sentence in a press release, and ask what happens to the commitment at renewal.

05. hyperexponential. A pricing and portfolio decision platform rather than a submission triage tool, which is a different job despite the shared shelf. Where it wins: depth in actuarial and pricing work, and unusually candid positioning about where it sits, its own site saying it comes earlier in the cycle and that your policy administration system stays the system of record. Where it costs you: the customer language is top global carriers writing across seventy five billion in annual commercial premium. That is a long way above this band. Diligence note: if your actual problem is that submissions are unsorted rather than that pricing is unsophisticated, this is a well-built answer to a question you did not ask.

06. Kalepa. An underwriting copilot for carriers, MGAs, mutuals, brokers and reinsurers. Where it wins: the product is squarely aimed at the risk selection decision, and its stated segment list includes the MGA rather than treating it as an afterthought. Where it costs you: a disclosure gap that is hard to explain away. Diligence note, and it is the sharpest one on this page: Kalepa's security page contains only a responsible disclosure policy for security researchers, and its trust address returns a 404. We found no SOC 2, ISO 27001, HIPAA or penetration testing claim anywhere on its public site. Every other vendor here at least asserts a certification, even where the report itself is gated. That is not evidence of a weak security programme, and it may simply be a marketing site that has not been updated. It does mean your first email should ask for the attestation, and that the answer will tell you a lot.

07. Convr and Indico Data, briefly. Convr is commercial underwriting AI selling to carriers, MGAs and brokers, and its published customer results are attributed to named insurers, which we credit. Its SOC 2 Type II announcement dates from September 2022 and we found no more recent attestation notice, so ask for the current report rather than assuming continuity. Indico Data is an intake and orchestration platform whose own customer language describes carriers at fifty billion dollar scale and top ten commercial insurers, and whose trust centre states SOC 2 Type II certification since 2021 with annual penetration testing. Both are credible. Neither is built around a buyer this size.

This is the question we would ask first, and it is the one the shortlists never raise, so it is worth being blunt about what we found.

Read the customer language across the ten and a pattern is immediate. Bevaya leads with three of the five largest US P&C carriers. Indico Data describes carriers at fifty billion dollar scale and top ten commercial insurers. hyperexponential says top global carriers, underwriting across seventy five billion in annual commercial premium. Send publishes twenty six billion in gross written premium through the platform. These are not products that happen to have enterprise customers. They are products whose reference accounts, implementation model and commercial terms are organised around enterprise customers, and a fifteen person specialty underwriting operation buying one of them is buying at the bottom of a range designed for somebody else.

There is one clear exception, and it comes from Federato itself. Its MGA page states, in its own words, that it is "purpose-built for growth-stage and scaling MGAs expanding across programs, carriers, and distribution partners", and the same page says deployment can run in as few as twelve to sixteen weeks. That is the most direct statement of mid-market fit anywhere in this research, and it is on the incumbent's own site rather than in a review. If you are an MGA or a program administrator growing across programs, Federato is telling you plainly that you are the intended buyer. Take the claim seriously, then test it in the reference call by asking to speak to the smallest MGA on their book.

Which brings the band question to its useful form. Our own view, which we have written on the insurance page, is that the eight to fifty million dollar revenue band describes most independent agencies and many MGAs. Inside that band the real constraint is rarely the sophistication of the risk model. It is that submissions arrive as unstructured email and somebody spends their morning triaging them by hand, and that the appetite lives in the heads of two experienced underwriters rather than in a system. Both of those are addressable, and neither of them requires a platform sized for a national carrier.

Three gaps run across this whole category, and they are the ones to put in the first email rather than discovering in month nine.

The trust centre is a door, not a document. Federato, hyperexponential and Indico Data all run formal trust centres, on Vanta, SafeBase and Carbide respectively. All three list the right things: Federato shows SOC 2 Type 2 and ISO 27001:2022 badges with a report dated November 2024, hyperexponential lists ISO 27001:2022 with SOC 2 Type 1 and Type 2, Indico states SOC 2 Type II since 2021 with annual penetration testing. In every case the underlying reports sit behind a request access flow. What is publicly verifiable is the claim, not the evidence. That is normal and it is not a criticism, but it means a shortlist built by reading trust centre badges has compared marketing assets rather than controls, and the actual comparison cannot start until someone signs an NDA.

Nobody volunteers the training question, and the wording rewards close reading. Federato's privacy policy contains a precise and useful sentence: Federato does not share any user data with external AI models. Read it carefully. It is a commitment about sharing with third party models, and it is a good one. It is not a statement about whether Federato trains its own models on your submissions, and its terms of use contains no clause on the subject either. Its trust centre lists a document called the Federato AI Policy, which is exactly where the answer probably lives, and which is gated. Bevaya's position has the same shape from the other direction: it says your data never appears as another customer's output, which is about leakage, while its own release describes InsurGPT as trained on three hundred million proprietary insurance documents, which invites rather than answers the question of whose. We are not alleging anything by either vendor. We are saying the public documents do not close the question, and that on submission data, which carries named insureds, loss history and broker relationships, it is a question worth closing in the contract.

Almost nobody names the core system. Of the ten, only Bevaya names specific policy administration and content systems on a public page. Every other vendor speaks about integration in the abstract, with phrases about connecting to existing core systems and downstream platforms. Since the integration is where these projects actually succeed or stall, ask for the named list, ask which of those are productised connectors versus a services engagement, and ask for a reference who runs your core.

If you want the longer version of this checklist written for any AI vendor rather than this category, it is in the security questions to ask before a build, and the ownership and exit side is in why code handoff matters.

We should say plainly where we stand, because this page sits on a consulting firm's website and a reader is entitled to know what we sell. We have not shipped a commissioned build for an MGA or a carrier underwriting operation. We say the same thing on our claims appraisal comparison and elsewhere on this site, and we would rather say it than imply a track record we do not have. What follows is a decision framework, not a pitch.

Buy, if the work is genuinely standard. Document extraction from ACORD forms, loss runs and statements of value is a solved problem, the vendors have spent years on it, and the training data advantage is real. If that is your constraint, rent it. Building your own extraction stack to save a subscription is the most common expensive mistake in this category.

Buy, if you are an MGA growing across programs and Federato's own description fits you. Their MGA positioning is specific and their implementation window is published. Test it with references at your size, and get the pricing model in writing early, since none of it is public.

Think harder if the shortlist has quietly become one vendor. If you run Applied software and your finalists are Planck and Cytora, you are not running a competitive process. Add a genuinely independent option or accept that you are negotiating an expansion, which is a different negotiation with different leverage.

Commission, in one specific case. Where the thing that makes you money is your appetite, and your appetite is unusual. Every platform here scores submissions against a definition of good risk. If your edge is that you write a class the standard market misreads, then a system whose scoring model was built for the standard market is being asked to encode the thing that makes you different, and that is the part worth owning rather than renting. That is a narrow case. It is also exactly the case where a fixed-fee build with the code handed over beats a subscription, and it is the conversation we are useful in. The rest of the time, one of the ten above is the better answer and we will say so.

If you want to size your own numbers before talking to anyone, the insurance benchmark takes a few minutes, what a commission costs sets the fee expectation, and how we work covers what happens after a call.

Related reading.

On the rest of the insurance stack: what we would build for an insurance operation, the consultants agencies actually shortlist, and what automation consulting covers here. On choosing a partner, how to choose an AI consultant for insurance. The neighbouring comparisons cover different layers of the same stack: Tractable and the claims appraisal layer, Quandri and renewal automation, the Quandri alternatives, the EZLynx alternatives, and Applied Epic against EZLynx, which is the other place on this site where two products turn out to share one owner. On the systems themselves, the AMS360 playbook, the Applied Epic playbook and the EZLynx playbook each cover building a layer on software you already own. On governance, governance without enterprise theater and how to run a pilot that produces a decision. Our forward view of the channel is in the 2027 agency benchmark, and the maturity assessment places your operation before any of it. The rest of the series sits on the comparisons hub, and pricing covers our own fee bands.