Security & Trust

Claim data is PII and PHI by definition. We designed around that from day one.

Medical records, diagnoses, and personal claimant details flow through every layer of RecommendedClaims. Here is how we keep that data encrypted, isolated, auditable, and explainable. These properties are the architecture itself, not an afterthought.

Four Pillars

The posture, in plain terms.

Encryption

Every claim file, extracted fact, and guidance record is encrypted at rest with customer-managed keys, and every connection uses TLS. Insecure transport is refused outright rather than merely discouraged.

Isolation

Tenancy is a configuration boundary enforced in every query and every storage key, not a shared table with a filter. Document access uses short-lived signed links instead of standing permissions, and admin actions require a separate, explicit role.

Auditability

Every admin action, configuration change, and guidance decision to accept, reject, or snooze writes an immutable, append-only audit entry recording who, what, when, and why. Nothing is overwritten, and corrections are recorded as new entries.

Point-in-time explainability

Guidance is versioned, not overwritten. Every score carries its per-feature contributions and every recommendation cites the fact and document it came from. You can reconstruct exactly why a claim was scored the way it was, as of any date.

Why It Matters

Point-in-time explainability is not a report. It is the record.

In disability and workers' comp, a guidance decision can be revisited months or years later by an auditor, a regulator, or an appeals reviewer. RecommendedClaims never overwrites a guidance record; it supersedes it.

Every version, kept

Each score, recommendation, and summary is written as a new version tied to the inputs that produced it. Nothing is silently updated in place.

Inputs are traceable

Every guidance version records a digest of the facts and features that fed it, so "what did the model know at the time" is always answerable.

Human decisions, captured

When an adjuster accepts, rejects, or snoozes a recommendation, that decision and the stated reason become part of the permanent claim record.

Operating Practices

What that looks like day to day.

Role-based accessAdjuster and admin roles are distinct; admin-only actions (user management, cost reporting, data deletion) are enforced server-side, not hidden by the UI alone.
No PII in logsApplication logs carry claim and document identifiers only. They never contain claimant names, dates of birth, or free text medical content.
Short-lived document accessDocument viewer links expire in minutes, not days, and are scoped to a single claim and a single session.
Perimeter protectionPublic-facing endpoints sit behind managed web-application firewall rules and rate limiting before a request ever reaches application code.

Data deletion on requestA single, audited operation can retire a tenant's derived data, including claims, facts, documents, and guidance, while preserving the original client delivery of record.
Grounded outputs by defaultExtracted facts and generated guidance must cite verifiable source text; anything that can't be verified against the document is dropped rather than shown.
Continuous monitoringInfrastructure changes and account activity are logged centrally, with budget and anomaly alerts wired to the team responsible.
Configurable residency postureTenant configuration, not a forked deployment, is the mechanism for future data residency and per tenant key requirements as we grow.