Satellite Flood Intelligence · Parametric Insurance

A single-frame satellite trigger cannot tell a flood from a shadow. When it fires a $2M payout on that guess, we adjudicate the trigger before the money moves.

Parametric flood cover pays automatically when a satellite says a location is under water. But one optical or radar frame cannot separate floodwater from a cloud shadow, a radar or terrain shadow, or a permanent reservoir, because all four darken the same pixels. TriggerProof takes the already-fired trigger as given and proves whether it should pay: a deterministic five-rule physics verifier decides, an LLM only advises, uncertain cases escalate to a human instead of auto-paying, and every decision leaves a forensic dossier. Agents advise, code decides.

$4.0M of $8.0M

Auto-queued payouts held or stopped for proof (3 false triggers suppressed, 1 escalated). The other $4.0M paid across 2 confirmed floods

Demo's synthetic 8-AOI portfolio scenario

0 unsafe

Unsafe automated decisions versus 48 for the single-frame baseline, which pays every flagged case

60-case labeled synthetic benchmark

100% / 100%

False-positive suppression (36/36) and flood recall (12/12) among the 80 percent auto-resolved

60-case labeled synthetic benchmark

A runnable demo of the adjudication mechanism. The verifier and policy gate run entirely in plain Python with no API key; only the advisory cross-reference agent can call a model, and it never decides the payout. Every satellite tile, area of interest, and ground signal is synthetic and physically faithful, not real Sentinel or insurer data.

A parametric payout is only as trustworthy as the trigger behind it

Parametric flood insurance traded the loss adjuster for a satellite trigger to make payouts instant. The trigger inherited a physics problem it cannot see past.

When a trigger fires, a payout of millions is released with no adjuster on site. The appeal is speed and the absence of dispute. The exposure is that a single frame, an NDWI or MNDWI reading on one optical image or one SAR pass, is being asked to decide whether ground is actually under water. It often cannot. A cloud shadow darkens an optical scene exactly where a flood would. A radar or terrain shadow drops SAR backscatter the same way real standing water does. A permanent reservoir reads as water because it is water, just not new water.

So the trigger's real failure mode is not the flood it misses. It is the confident false positive: a payout fired on a shadow, released before anyone can check, and with no record that would let a reinsurer or an auditor test the call afterward. That is basis risk in its most expensive form, paying on a trigger that was never a loss, and it is the structural weakness a parametric flood book carries, not a rare edge case.

A better single image does not close this. Neither does a smarter model asked to score the same lone frame. Separating floodwater from its three look-alikes is a question of how a signature behaves across time and across sensors, and of whether the decision can be defended later. Those are the two gaps we set out to close, and neither of them lives inside a detection model.

A deterministic verifier decides the payout; the LLM only advises

The pipeline takes a fired trigger and returns PAY, DENY, or ESCALATE. The decision lives in plain, inspectable code, never in a model.

TriggerProof does not detect floods. It adjudicates a trigger that has already fired. Each fired trigger runs through a five-rule physics verifier, is checked against independent ground signals by an advisory agent, and is then routed by a policy gate that either pays it, denies it, or escalates it to a human. Every case emits a forensic dossier at the end.

Fired trigger → 5-rule deterministic physics verifier (pure Python) → Contextual Cross-Reference Agent (advisory) → policy gate (PAY / DENY / ESCALATE) → forensic dossier (JSON + printable HTML + SHA-256). Classifications: flood / cloud_shadow / radar_shadow / permanent_water / no_trigger.

The deterministic trust core

The five-rule verifier is plain Python with no model in the loop. It emits a classification and a confidence score, and it is the part that decides whether a trigger is a real flood. It is inspectable and reproducible: run it again on the same case and you get the same verdict and the same per-rule readings, which is what lets a reinsurer or an auditor test the decision rather than take it on faith.

The agent, bounded to advice

A Contextual Cross-Reference Agent, built on Pydantic AI and defaulting to claude-opus-4-8, checks the physics verdict against independent ground signals such as a river gauge, precipitation, and field reports, and returns corroborates, contradicts, or inconclusive. It is provider-swappable and has a deterministic fallback so the demo runs fully offline. It advises and can be overruled. It never decides the payout.

The five discriminators the verifier enforces

Rule	Discriminator	What it separates
R1	Temporal persistence	A flood persists across acquisitions; a cloud shadow is transient and gone in the next frame.
R2	SAR-optical agreement	A flood is optical-dark and SAR-low; a cloud shadow is optical-dark but SAR-normal; a radar shadow is SAR-low but optical-bright.
R3	DEM slope	Water cannot pool on steep terrain, which flags layover and terrain shadow.
R4	Permanent-water mask	Known reservoirs and lakes are excluded, catching the new-reservoir false trigger.
R5	Hydrological linkage	A real flood connects to the drainage network; an isolated dark patch does not.

The policy gate makes the thresholds auditor-visible. If the agent contradicts the physics, or if confidence falls below the fitted automation bar of 0.65, the case is escalated to a human as needs proof, never auto-decided. Otherwise a flood classification pays and any non-flood class is denied. The durable value is the verifier and the gate, not a sharper detector: even a perfect single-frame classifier still cannot escalate the ambiguous case or hand a reinsurer a defensible record. Those are governance jobs, and they sit outside the detection model by design.

The book, adjudicated on screen

Every figure below is the reproducible output of the demo's deterministic harness, computed at runtime. Every area of interest, river gauge, and field report is synthetic and physically faithful. No real Sentinel scene, location, insurer, or claim is used.

Before: $8.0M queued on 6 fired triggers

A storm passes a book of 8 areas of interest. The legacy single-frame trigger has fired on 6 of them and queued 8.0 million US dollars in automatic payouts. Nothing in this view distinguishes a real flood from a shadow or a reservoir, because a single frame cannot. Every fired row is about to run through the verify, cross-reference, and gate stages.

The TriggerProof adjudication book before adjudication, listing 8 areas of interest AOI-A through AOI-H with dollar stakes, a legacy PAY badge on the 6 fired triggers totalling 8.0 million dollars, and pending verify, cross-reference, and gate stages on each fired row. — The book before adjudication: 6 single-frame triggers, $8.0M queued to auto-pay, no way yet to tell a flood from a shadow.

After: 2 pay, 3 denied, 1 escalated

TriggerProof adjudicates the book. It confirms 2 real floods to pay for 4.0 million US dollars, suppresses 3 false triggers for 3.2 million withheld (a cloud shadow at 1.2 million, a radar shadow at 1.0 million, and a permanent reservoir at 1.0 million), and escalates 1 borderline case at 0.8 million to a human. Of the 8.0 million the legacy trigger would auto-pay, 4.0 million is stopped or held for proof, and every decision carries a forensic dossier, so evidence coverage reads 100 percent.

The adjudication book after TriggerProof runs, showing 8.0 million legacy queued resolved into 4.0 million confirmed to pay across 2 floods and 4.0 million withheld across 3 suppressed and 1 escalated, with a per-row classification of flood, cloud shadow, radar shadow, or permanent water, confidence, and ground cross-reference, and 100 percent evidence coverage. — After adjudication: $4.0M confirmed to pay, $4.0M withheld across 3 suppressed false triggers and 1 escalation, one dossier per decision.

Why a $1.2M shadow was denied: the shadow moved

Open AOI-B, Mesa Junction Depot, and step through the acquisition frames. The dark optical patch that fired the trigger appears only in the trigger frame and is gone in the next acquisition, while SAR backscatter stayed normal throughout. Radar saw dry ground through the cloud. The verifier classifies it cloud shadow at confidence 1.00 and denies the 1.2 million US dollar payout. The shadow moved; real floodwater would have stayed.

The temporal filmstrip for AOI-B Mesa Junction Depot, classified cloud shadow and denied at confidence 1.00, with optical NDWI frames on top and SAR frames below across three acquisitions, the dark water signal flagged as a cloud-shadow false positive only in the trigger frame, and a physics evidence table showing R1 temporal persistence and R2 SAR-optical agreement both failing. — AOI-B, denied: the dark patch shows only in the trigger frame and SAR stayed normal, so R1 and R2 fail. A cloud shadow, not water.

Why a $2.0M flood was paid: the water stayed

The same filmstrip on AOI-A, Rio Verde Terminal, shows the opposite. The water signature persists across every acquisition frame in both optical and SAR, the terrain is flat enough for water to pool, the region connects to drainage, and the independent river gauge corroborates. The verifier classifies it flood at confidence 0.99 and pays the 2.0 million US dollar trigger. The mechanism is not biased toward denial; it is biased toward proof, and here the proof is present.

The temporal filmstrip for AOI-A Rio Verde Terminal, classified flood and paid at confidence 0.99, showing a persistent water signature across all three optical and SAR frames, with a physics evidence table where R1 temporal persistence, R2 SAR-optical agreement, and R3 DEM slope all pass, and a ground cross-reference that the river gauge corroborates. — AOI-A, paid: a persistent optical and SAR signature on flat, drained terrain, corroborated by the river gauge. A real flood.

The uncertain case goes to a human, not to a coin flip

AOI-F, Canal Street Hub, is the case the physics cannot resolve. The signature is borderline, the verifier's confidence lands at 0.15, and the independent river gauge never crossed bankfull, so the ground evidence conflicts with the trigger. Because confidence is below the 0.65 automation bar, the policy gate escalates the 0.8 million US dollar case to a human adjudicator with the full evidence attached, rather than gambling on an automatic call. Escalating the ambiguous case is the design, not a failure of it.

The escalated case AOI-F Canal Street Hub, classified flood at confidence 0.15 and marked ESCALATE, with a borderline optical and SAR signature across frames, a note that the independent river gauge never crossed bankfull so the ground evidence conflicts, and a decision panel routing it to a human adjudicator as needs proof. — AOI-F, escalated: confidence 0.15 is below the 0.65 bar and the gauge conflicts, so the $0.8M case routes to a human with evidence.

The receipt: a forensic dossier per decision

Every verdict emits a forensic flood-trigger dossier. It carries the per-rule evidence for all five discriminators with their measured values and pass or fail results, a false-positive elimination log, the contextual cross-reference verdict, the data lineage for each simulated acquisition, and a SHA-256 provenance hash of the decision. To be exact about scope, the SHA-256 hash is a content hash for tamper-evidence, not a PKI digital signature, and the imagery is synthetic. What the dossier proves is that the decision is documented rather than asserted.

The forensic flood-trigger dossier for the denied cloud-shadow case at AOI-B, showing a DENY verdict, a per-rule evidence table for R1 through R5 with measured values and pass or fail results, a false-positive elimination log, a contextual cross-reference marked corroborates, a Sentinel-1 and Sentinel-2 data lineage table, and a provenance section. — The dossier: per-rule evidence, a false-positive elimination log, the ground cross-reference, the Sentinel data lineage, and a SHA-256 provenance hash.

Across 60 labeled cases: never an unsafe automated call

The single book is not a lucky run. Over a fixed benchmark of 60 labeled synthetic cases, from clear signatures to near-threshold noise, TriggerProof makes 0 unsafe automated decisions against 48 for the single-frame baseline, which pays every flagged case. It auto-resolves 80 percent and escalates 20 percent, and among the auto-resolved cases it suppresses 36 of 36 false triggers and pays 12 of 12 real floods. The claim is deliberately narrow: on this labeled set the system never makes an unsafe automated decision, because it escalates when the physics is uncertain.

The evaluation panel over 60 labeled synthetic cases showing 0 unsafe automated decisions versus 48 for the single-frame baseline, 80 percent auto-resolution with 20 percent escalated for proof, 100 percent false-positive suppression at 36 of 36 false triggers denied, and 100 percent flood recall at 12 of 12 auto-paid, with a table of labelled cases each marked correct. — The 60-case benchmark: 0 unsafe automated decisions versus 48 for the baseline, 80 percent auto-resolved, 100 percent suppression and recall among them.

Where this layer sits, and where it does not

It is the adjudication and governance layer between a fired trigger and the payout, not a satellite-data product and not a flood detector.

Concern	A single-frame trigger alone	This adjudication layer
A cloud shadow, radar shadow, or reservoir	Paid as a flood; all four darken the same pixels	Denied by five deterministic physics rules across time and sensors
A genuinely ambiguous case	Auto-paid on a coin-flip signal	Escalated to a human below a 0.65 confidence bar, with evidence attached
Why a trigger was paid or denied	No record beyond the fired flag	A forensic dossier: per-rule evidence, elimination log, SHA-256 provenance
Who makes the payout call	A pixel threshold on one frame	Deterministic Python; the LLM advises and can be overruled
Basis risk from false triggers	Borne in full on every non-flood it flags	0 unsafe automated decisions versus 48 on the 60-case labeled benchmark
Model and vendor lock-in	Tied to one detector's output	Verifier runs offline; the advisory agent is provider-swappable

What this demo does not do

Every satellite tile, area of interest, river gauge, precipitation reading, and field report is synthetic and physically faithful. There is no real Sentinel or ICEYE scene, no real location, and no real insurer or claim.
The 0 unsafe, 80 percent auto-resolution, and 100 percent suppression and recall figures are on a fixed, labeled set of 60 synthetic cases, not an open-world or field guarantee. Validation against real archives such as Sen1Floods11 or a live Sentinel book is the first engagement deliverable, not this demo.
The $4.0M of $8.0M held or stopped is from the demo's synthetic 8-AOI portfolio scenario, not a real book of business.
All connectors are stubbed or simulated: Sentinel-1 and Sentinel-2 retrieval, commercial SAR tasking, co-registration, ground-signal feeds, and claims-platform integration. The SHA-256 provenance is a content hash for tamper-evidence, not a PKI digital signature.
TriggerProof adjudicates an already-fired trigger. It does not detect floods and does not produce satellite data; it is not a Sentinel or ICEYE detector clone.
The advisory agent never decides the payout. The deterministic verifier and the policy gate decide, and the agent can be overruled.
There are no real customers, deployments, named users, testimonials, or claimed ROI. The honest frame is what we found in building this demo.

Questions buyers ask

We already pay automatically on the satellite trigger. Why add a step between the trigger and the payout?

Because a single-frame trigger cannot tell floodwater from a cloud shadow, a radar or terrain shadow, or a permanent reservoir, and all three go dark the same way. When a payout fires on that call, probably flooded is not good enough and there is no evidence trail to defend it later. TriggerProof takes the fired trigger as given and adjudicates it into PAY, DENY, or ESCALATE using deterministic physics. On the demo's 8-AOI synthetic portfolio, that stops or holds 4.0 million US dollars of 8.0 million in auto-queued payouts.

The whole point of parametric was to remove the loss adjuster. Doesn't a human in the loop bring the delay back?

Only for the cases that are genuinely ambiguous. On the 60-case labeled benchmark TriggerProof auto-resolves 80 percent and escalates 20 percent, so the clear floods still pay straight through and only the borderline or contradicted cases route to a person, with the full evidence already attached. That is the trade: a fast automatic payout stays fast, and the case that would otherwise be a confident false positive gets a human instead of a wrong 0.8 million US dollar call.

Is this real satellite data? Which floods did you actually run this on?

None. Every tile, area of interest, river gauge, precipitation reading, and field report in the demo is synthetic and physically faithful, and there is no real Sentinel scene, real location, real insurer, or real claim. The connectors for satellite retrieval, SAR tasking, ground-signal feeds, and claims-platform integration are stubbed. Field validation against real archives such as Sen1Floods11 or a live Sentinel book is the first engagement deliverable, not something this demo claims.

How is this different from just buying a better flood-detection model or a sharper satellite?

A sharper single image still cannot separate a flood from a shadow or a reservoir on its own, because the problem is temporal and cross-sensor, not resolution. TriggerProof does not detect floods and does not produce satellite data. It adjudicates an already-fired trigger by checking persistence across acquisitions, agreement between SAR and optical, terrain slope, a permanent-water mask, and hydrological linkage. The durable value is the governance layer around the decision, which is why it does not age out as detection models improve.

When it escalates a case, what does my adjudicator actually get to work with?

A forensic dossier, not a bare score. Each decision emits the per-rule evidence for all five discriminators with their measured values and pass or fail results, a false-positive elimination log, the independent ground cross-reference, the satellite data lineage, and a SHA-256 provenance hash of the decision. It exports as JSON and printable HTML, so an adjudicator, a reinsurer, or an auditor can see exactly why a case was paid, denied, or held for proof.

Those benchmark numbers, 0 unsafe and 100 percent suppression and recall. How much can I trust them?

They are on a fixed, labeled set of 60 synthetic, physically-faithful cases spanning clear signatures to near-threshold noise, not an open-world or field guarantee. On that set TriggerProof makes 0 unsafe automated decisions versus 48 for the single-frame baseline, and among the auto-resolved cases it suppresses 36 of 36 false triggers and pays 12 of 12 real floods. The point is not a perfect score, it is that the system never makes an unsafe automated decision, because it escalates when the physics is uncertain.

Does this lock us into your models, or a specific cloud or satellite vendor?

No. The deterministic verifier and the policy gate are plain Python and run fully offline with no API key, so the payout decision never depends on a model being available. The advisory agent is built on Pydantic AI and is provider-swappable across Anthropic, OpenAI, Gemini, and Ollama, defaulting to claude-opus-4-8 with a deterministic fallback. The satellite retrieval and claims integration are designed as adapters, so the layer sits on the sensors and platform you already use.

Technical Research

The research behind this demo — the architecture, the verification design, and the enterprise blueprint.

Beyond Single-Frame Inference: Enterprise Flood Intelligence (interactive whitepaper)

Full solution

Explore the Satellite Flood Intelligence for Parametric Insurance solution →

Put the adjudication layer between your flood trigger and the payout

Suppress the false triggers by physics, escalate the uncertain ones to a person, and leave a defensible record for every decision.

If your team runs an automatic flood-trigger book and is working out how to keep the payout fast without paying on a shadow, we would like to compare notes on where you draw the line between an automatic call and a human one. It is a hard boundary and we are still refining ours.

Trigger-book adjudication review

✓ Map where cloud shadow, radar shadow, and reservoirs create false-trigger exposure
✓ Encode your flood physics as deterministic, inspectable verification rules
✓ Set the confidence bar and escalation policy your underwriters and reinsurer will accept
✓ Define the forensic dossier an auditor can test after the fact

Build with us

✓ A five-rule deterministic physics verifier for PAY, DENY, and ESCALATE
✓ A provider-swappable advisory cross-reference agent, offline fallback included
✓ A policy gate with an auditor-visible automation bar
✓ A SHA-256 provenance dossier per decision, over adapters to your satellite and claims stack

Connect via WhatsApp Email Our Team