Security & deployment

Your clients’ claims, in your environment, under your controls

Client claims carry privileged strategy, personal data and E&O exposure. InsightAdvocate is built so a broker’s security, compliance and model-risk teams can see exactly what it does — and what it never does.

Security

Identity, scope and a record of everything

Identity

Sign-in through the Insight identity platform with your identity provider (OIDC) or local accounts; short-lived access tokens with refresh; roles for advocates, account executives, practice leaders, analysts and compliance.

Tenancy

Every row belongs to an organization. A token for an unknown organization sees nothing: requests fail closed.

Scope

What each person may open follows their role; lead-only pages (autonomy, new rules) are closed to everyone else. The copilot’s lookups use the same scope as the screens.

Dry-run sends

Notices, rebuttals, escalations, requests and updates are sent through a dry-run provider today: recorded with a message id, nothing leaves the product until a delivery channel is configured.

Decision record and audit

Control hits with rule versions, every prepared decision and the person who answered it, sign-offs, and an audit row for each change, including what an agent prepared and on whose behalf.

Uploads

Carrier letters and documents pass the platform’s upload checks before they are read.

Model risk

AI-first, with the controls model-risk asks for

Grounded figures

Engines compute every figure; an answer with a number not in the facts is discarded.

Capped autonomy

Every action at most L2, ask first; the tenant ceiling is configuration, not a user setting.

Traces and prompts

Each agent step with its model, tokens, cost and trace; prompts versioned with local defaults.

Tests without a model

The test suite refuses Bedrock at the AWS client; engines are tested on known answers.

Regulatory timelines are illustrative

The SLA engine runs each carrier’s service-agreement terms alongside a set of illustrative model regulatory timelines (acknowledge, decide, pay, respond). They are configurable examples, not any state’s law. Notice deadlines are read from each policy’s wording. Nothing in the product or on this site is legal advice.

Deployment

Your cloud, your database, your model account

Application

A Python API (FastAPI) and a React UI, deployed in your cloud account, behind your network controls.

Data

PostgreSQL, in a schema of its own; the database password is a secret reference (AWS Secrets Manager, Azure Key Vault, a file or an environment variable), never in a URL. Documents go to your object store.

Model

Claude on Amazon Bedrock in your own AWS account: Haiku 5.5 for the agents, Sonnet 5.5 for the copilot. Switch either off and the product still runs on its engines.