Security and compliance

Where it runs, and how carriers are kept apart

Infrastructure: AWS, in one InsureSight account in us-east-1: containers across multiple availability zones behind a load balancer. Infrastructure is defined as code in OpenTofu, and application changes are deployed by a pipeline from pull requests with automated tests.
Carrier separation: Each carrier gets its own phone line, its own servicing connection and its own credentials to its policy system, held in AWS Secrets Manager. Access control lets each connection read only its own carrier's credentials, so one carrier's connection cannot reach another's system.Shared data stores are partitioned by carrier and checked by automated tests.
Encryption: TLS 1.2 or later in transit. Encrypted at rest with AWS KMS in every table and bucket.

Read live, not copied: Policy, billing and claim answers are read from your policy system at the moment they're asked.
What we keep: What the service needs: a recording and transcript of each call, linked to the policy it was about; a summary for your team; and a renewal index of each policy's number, name, status, expiry and risk flags.
Verification: The last four digits of the driver's license, or the ZIP. Never a Social Security number.
Card payments: Payments are made on your own portal. We never request, capture or store card details. If a caller starts reading a card number aloud, the agent interrupts, and card numbers are redacted from our call recordings and transcripts.

Models: Pinned in configuration, not chosen at run time: Amazon Nova Sonic for speech, and Anthropic's Claude on Amazon Bedrock for reasoning and call summaries. Prompts are versioned in source control, like code.
No consequential decisions: It answers questions about a policy the caller already holds. It does not price, bind, decline, adjudicate or change coverage, and the carrier connection it uses has no way to.
It won't guess: When your system doesn't answer, it says it can't check right now, rather than filling the gap with a plausible answer.
A person is always one step away: Any caller can ask for someone, and your team gets a callback with a note of what they need. Asked whether it is a person, it says it is a virtual assistant.

SOC 2: Type I in progressControls are in place and mapped to the Trust Services Criteria.
NAIC AI Model Bulletin: MappedA requirement-by-requirement mapping, gaps included, for your model-risk team.
HIPAA: Not applicablePolicy servicing handles no protected health information.
PCI DSS: Out of scope by designCard details are never requested or stored; see card payments above.
Outbound calling (TCPA): Designed inConsent, identification at the start of the call, opt-out on every call and calling hours, before any call is placed.

Ask for the full mapping. It is written for reviewers, and every gap in it is a real one. hello@insuresight.ai

Connect us to your policy system and we'll show you, on your own book, the calls it resolves and the renewals it catches.