Security and data protection, built in at the core.
Claims data is sensitive. The platform was designed around protecting it from the first line of code: isolated by the database, encrypted end to end, hosted in the US, and never used to train AI.
Security documentation is shared directly with your review team.
Enforced by the database, not the app.
- Each client walled off at the database level
- Row-level security on every table
- Isolation re-tested against production daily
No project for your IT team.
- No inbound connection
- No firewall change
- No VPN
- No static IP allowlisting
- No long-lived credentials
US-hosted, encrypted, restorable.
- AWS us-east-1
- AES-256 at rest · TLS 1.2+ in transit
- Nightly backups · restore tested Aug 2026
- 12 named sub-processors
The AI advises. A person decides.
- Zero data retention (ZDR) on every AI call
- Never used to train models
- Consolidating on Claude via AWS Bedrock, US regions
- Models pinned to a version
Enforced at the database and logged.
- Role-based access
- Activity logging
- Internal access with MFA
- 48-hour incident notice
Same gates for every change.
- Protected main, no admin bypass
- Automated security gates
- Four layers of testing
- No critical, high or medium findings in external assessment
Questions from security reviewers.
Is our data used to train AI models?+
No. Every AI call runs under zero data retention (ZDR): nothing is stored by the model provider and nothing is used for training. AI output is advisory and a person makes the decision.
What do we need to install or open?+
Nothing. There is no inbound connection, firewall change, VPN, static IP allowlist or long-lived credential.
How is our data kept separate from other clients?+
Row-level security on every table, enforced by the database itself. Live probes against production with real credentials return zero cross-client rows, and the test re-runs daily.
What independent assurance is in place?+
A black-box security assessment in September 2026 found no critical, high or medium issues. A third-party penetration test is engaged, and our SOC 2 Type II observation period begins October 1, 2026, through Scytale, with an independent CPA opinion at its close.
Running a security review?
Contact us for more details. We’ll walk your reviewers through the controls and answer their questions directly.