HIPAA-grade security, by construction.
Captive data is claimant data. Workers' compensation, liability and healthcare captives carry names, dates of loss and medical detail, which is protected health information when it comes from a health plan or provider. The platform is built to the HIPAA Security Rule's safeguards and treats every firm's data as confidential by design, not by policy.
Encryption and key control
- AES-256-GCM, a key per firm
Every original document is encrypted with AES-256-GCM before it is stored, under a key derived for your firm alone. Claimant names, notes and provider keys are sealed the same way. A key for one firm cannot open another firm's data.
- Keys never touch the database
Encryption keys live only in the application's protected environment, never in the database or in a file. Decryption happens on the server, for a signed-in reviewer, and nowhere else.
- Encrypted in transit and at rest
TLS 1.2 or higher on every connection, HSTS enforced. The database and object storage are encrypted at rest by the hosting provider in addition to the per-firm layer above.
- Minimum necessary, in motion
Alerts, digests and the phone assistant carry counts, codes and links, never claim detail. Bank memos are redacted against the captive's known claimant names before they are stored.
Strict access controls
- An authenticator on every account
No public sign-up. Every person is invited by a firm administrator and must enrol an authenticator app before seeing anything. Sessions end after 30 idle minutes and 12 hours regardless.
- Roles that follow the minimum-necessary rule
Viewers see aggregates only. Reviewers see claim-level detail, and every view of it is logged. Owners and directors get a read-only seat that never shows a claimant or a file. Administrators manage people and settings, not data.
- One firm, one boundary
Every query runs through a tenant-scoped layer; tables carry composite foreign keys to the firm and an immutable tenant id, with row-level security on every table and no browser-side database access. A row from another firm cannot be reached even by its id. We test this on every deployment.
- Your identity provider
Password with authenticator, Google, Microsoft Entra or SAML, chosen per firm. A seat can be claimed only through a sign-in method the firm allows.
Audit and integrity
- Append-only audit log
Every view of claim-level detail, every approval, export, sign-off and settings change is logged with who, when and what, and cannot be edited or deleted. Administrators receive unusual-access alerts.
- Four eyes on every close
Nothing reaches the ledger unapproved. The preparer of a close cannot sign its manager review. A close cannot finish with open errors or missing documents.
- Evidence on every figure
Each finding points to its row, or page and line. Every package lists each document with its SHA-256, so an auditor or examiner can verify exactly what was relied on.
- Retention you control
Documents are kept for the retention period your firm sets (default seven years) and then purged. Your data is exportable at any time, and deleted on request when you leave.
HIPAA
Healthcare captives, risk retention groups and medical stop-loss programs handle protected health information. For them, the platform is operated as a business associate.
- Business Associate Agreement
We sign a BAA with each customer whose captives carry protected health information, covering permitted uses, safeguards, breach notification and subcontractors.
- Security Rule safeguards
Administrative, physical and technical safeguards are mapped control by control: risk analysis, workforce access, audit controls, integrity, person authentication, transmission security. The mapping is in the trust pack.
- Subcontractors under the same terms
Hosting, database and AI providers are used under agreements that match the BAA: no training on customer data, zero retention for model calls, encryption at rest and in transit, US regions.
- What HIPAA does not offer
There is no HIPAA certification. We do not claim one. We show the controls, the mapping and the agreements, and we answer the questionnaire your largest client's auditor will send.
How AI is used, and how it is not
Examiners now ask service providers how they use AI. The answers:
- Reading and reconciling is code, not a model
Loss runs and statements are parsed and checked by deterministic code with tests. Findings are reproducible; the same file gives the same result every time.
- The agent never sees a claimant
Captives are replaced by keys before a question is sent; claimant names and claim numbers never leave the platform, and every answer is screened again on the way back.
- Zero retention, no training
Model providers are used under zero-data-retention terms; customer data is never used to train anything. Each firm chooses its provider and key; the Anthropic option is covered by Anthropic's BAA.
- A person decides
No model approves a document, changes a figure or signs a close. The platform prepares; your accountant reviews.
The trust pack
Sent before the first meeting: the security summary, the HIPAA control mapping, the Business Associate Agreement and data-processing agreement, our insurance certificate (technology E&O and cyber), and the answers to the questionnaire your largest client's auditor will send.
Penetration testing and a SOC 2 Type I report are scheduled and will be listed here with dates once complete; we do not claim them before then.
Start with a quarter you have already closed.
Managers: two or three captives, one finished quarter, a fixed pilot fee credited in full against setup. Owners: tell us who manages your captive today and we take it from there. Nobody signs anything until they have seen the result.