Who legally owns the policy data, extracted fields, and certificates issued?

Your agency retains 100% exclusive commercial, legal, and intellectual property ownership of all documents uploaded, structured data extracted, and certificates issued. Insure Assist AI claims zero ownership rights in your data.

Where is our agency data physically hosted and processed?

All production databases, policy documents, and backups are hosted 100% within the United States inside Google Cloud Platform data centers in the us-central1 (Iowa) region. We maintain zero non-US routing or offshore storage.

How does PostgreSQL Row-Level Security guarantee that other brokers cannot see our data?

We enforce dual-layer tenant isolation: First, every API request cryptographically validates the agency token and injects mandatory brokerId filters. Second, at the relational database kernel level, PostgreSQL FORCE ROW LEVEL SECURITY (RLS) restricts database transactions to the active agency session identifier, mathematically blocking cross-tenant access.

Does the platform support Multi-Factor Authentication (MFA)?

Yes. Multi-Factor Authentication (MFA) is supported across all agency accounts, adding a critical second layer of protection beyond passwords to satisfy NY DFS 500 § 500.12 and GLBA cybersecurity standards.

What happens to our agency data if we terminate our subscription?

Under our standard Enterprise Data Processing Addendum (DPA), upon termination of your subscription, all client documents, policy records, and issued certificates are permanently and irreversibly deleted from production databases within 30 days.

How do we obtain security architecture documentation for our agency compliance audit?

We provide agency principals, operations leaders, and compliance officers with complete architectural and security documentation upon request. Simply email our security desk at security@insureassistai.com.

verified_userEnterprise Security & Data Governance

Enterprise Security & Tenant Isolation Built for Independent Commercial Brokerages

Built from the database layer up to protect policyholder Nonpublic Information (NPI). Our platform enforces dual-layer agency isolation, zero AI model training on your policies, and alignment with state and federal insurance data privacy requirements.

storageView Technical Architecture menu_bookRead Security Support Guide mailContact Security Desk

Data Ownership

100% Agency-Owned

Zero vendor property claims

Data Residency

100% US-Hosted

Google Cloud us-central1

Database Tenancy

PostgreSQL FORCE RLS

Kernel-enforced isolation

AI Data Privacy

Zero Model Training

Private Vertex AI endpoints

Enterprise Defense-in-Depth

The Six Pillars of Insure Assist AI Platform Trust

Architected to protect commercial policy data and support your agency's compliance obligations under state insurance regulations and the GLBA Safeguards Rule.

shield_lock

Dual-Layer Multi-Tenant Isolation

Kernel-level PostgreSQL RLS & Application BOLA

Brokerage data is separated by hardware-enforced relational database rules. Every transaction binds to your unique agency ID, making cross-tenant data access mathematically impossible.

check_circlePostgreSQL FORCE ROW LEVEL SECURITY on all tenant tables
check_circleCryptographically decoded JWT token verification on every API route
check_circleMandatory brokerId filters at application code and database layer
check_circleZero cross-tenant data leakage or shared prompt contexts

lock

Cloud Infrastructure & Cryptography

100% US Google Cloud Hosting with AES-256

All compute and database storage reside exclusively in Google Cloud Platform US data centers (us-central1). Data is shielded with state-of-the-art encryption in transit and at rest.

check_circleEnforced TLS 1.3 encryption with HTTP Strict Transport Security (HSTS)
check_circleHardware-accelerated AES-256 disk and cloud storage object encryption
check_circleCloudflare Enterprise edge WAF and automated DDoS protection
check_circleZero non-US data transit or off-shore hosting dependencies

psychology_alt

Enterprise AI Privacy & Zero-Retention

Stateless execution with zero model training

Your policy declarations, schedules, and client PII are never fed into public foundation models. Ingestion and extraction occur via stateless private enterprise API endpoints.

check_circleZero model training guarantee: Customer data never trains public LLMs
check_circlePrivate enterprise Google Vertex AI infrastructure with enterprise data protection
check_circleStateless document parsing with ephemeral inference memory destruction
check_circleAgency retains 100% intellectual property and data ownership

badge

Identity Governance & Access Control

Multi-Factor Authentication & Granular RBAC

Rigorous access controls ensure team members only access authorized operational functions, backed by Multi-Factor Authentication (MFA) and cryptographic session management.

check_circleMulti-Factor Authentication (MFA) enforcement across all agency accounts
check_circleGranular Role-Based Access Control (Admins, Producers, CSRs, Auditors)
check_circleSeparation of administrative privileges from daily certificate issuance
check_circleTime-limited cryptographic session tokens with automatic timeout

cloud_sync

Business Continuity & Cloud Resilience

Automated multi-zone snapshots & high availability

Engineered for continuous commercial brokerage operations with automated replication, multi-zone failover capabilities, and regular snapshot protection.

check_circleAutomated daily multi-zone database snapshots with point-in-time recovery
check_circleContainerized microservices running on Google Cloud Run with multi-zone redundancy
check_circleGeo-redundant Google Cloud Storage for policy documents and certificates
check_circleZero single points of failure in core document processing pipelines

verified_user

Regulatory Due Diligence Support

Engineered for NY DFS 500, NAIC 668 & GLBA

Technical controls and data governance specifically designed to assist independent brokerages in meeting their statutory third-party service provider due diligence obligations.

check_circleDesigned to support agency compliance with NY DFS 23 NYCRR 500 § 500.11
check_circleSupports NAIC Insurance Data Security Model Law (#668 § 4) vendor oversight
check_circleContractual safeguards aligned with FTC / GLBA Safeguards Rule (16 CFR Part 314.4)
check_circleDirect engineering security support available for agency compliance reviews

Technical Architecture

Dual-Layer Tenant Isolation & Cryptographic Boundaries

Unlike generic SaaS applications that rely solely on software code to separate customer accounts, Insure Assist AI pairs application-level Broken Object Level Authorization (BOLA) with hardware-enforced PostgreSQL kernel Row-Level Security (RLS).

Insure Assist AI Multi-Tenant Isolation Architecture — Figure 1: Dual-layer tenant isolation: Cloudflare Edge WAF, JWT token validation, application BOLA, and PostgreSQL FORCE RLS.

lock_person1. Application Layer (BOLA Prevention)

Every incoming API request cryptographically decodes verified session claims signed by Google Cloud identity services. Database queries strictly inject the authenticated brokerId, rejecting unauthorized cross-tenant requests.

storage2. Database Kernel Layer (PostgreSQL FORCE RLS)

Before executing any SQL query, database connections set a session config variable matching the active agency identity. PostgreSQL enforces FORCE ROW LEVEL SECURITY, guaranteeing that even a compromised application query cannot read rows from another agency.

memory3. Stateless AI Processing (Zero Retention)

Policy OCR and document extraction execute in ephemeral container memory over private Google Cloud Vertex AI connections. No customer policy texts, dec sheets, or FEINs are stored in shared AI caches or used to train public foundation models.

verifiedThird-Party Service Provider Oversight

Have Questions About Your Agency's Compliance Review?

Agency principals, compliance officers, and IT committees often require structured documentation to satisfy state due diligence requirements (such as NY DFS 23 NYCRR 500 § 500.11, NAIC Model 668 § 4, and the GLBA Safeguards Rule). Our engineering security desk assists qualified brokerages directly with questionnaires, architectural specifications, and data protection agreements.

quizPre-Filled Vendor Questionnaire

Standard Information Gathering (SIG Lite) responses covering hosting, encryption keys, access governance, and recovery protocols.

architectureArchitecture & Tenancy Whitepaper

Detailed technical breakdown of PostgreSQL Row-Level Security, BOLA prevention, and stateless Vertex AI inference boundaries.

gavelStandard Enterprise DPA

Ready-to-sign Data Processing Addendum confirming 100% agency data ownership and guaranteed 30-day post-termination data wipe.

mailContact Security DeskDirect inquiries monitored by our engineering security desk: [email protected]

Common Security Inquiries

Frequently Asked Security Questions

Key questions asked by commercial agency owners and risk managers before onboarding.

Never. Insure Assist AI operates under a strict Zero-Model-Training policy. Your commercial policy uploads, loss runs, ACORD forms, FEINs, and commercial driver schedules are processed over private enterprise Google Cloud Vertex AI endpoints and are never used to train, retrain, or improve public or foundation artificial intelligence models.