InsurOps 2026 Fall ReleaseSee what’s new →
Assurified
Log in
InsurOps Trust Center

InsurOps secures your risk data with institutional controls.

The platform stores policies, loss runs and resident program data and protects them with independent assurance, governed AI and regional recovery.

Request the SOC 2 reportReport a security issue
AICPA SOC for Service OrganizationsSOC 2 Type IIThe report is available under a nondisclosure agreement.
ATTESTATION

Independent examination

We have a SOC 2 Type II report issued by an independent auditor, Baker Tilly.

AI

Governed AI

Every value links to its source, reviewers approve low-confidence results before the record changes, and your data never trains shared foundation models.

RECOVERY

Availability and recovery

The production database replicates in near real time to a standby AWS region, and continuous monitoring covers performance, logs and health.

02Security

InsurOps protects data at the network, the identity layer and each record.

It combines protected hosting, encryption, federated identity, tenant isolation and an auditable review trail.

Hosting and network

  • The InsurOps portal, APIs and data hub are hosted on a DOD-grade, isolated AWS private cloud.
  • A web application firewall protects the public HTTPS endpoints.
  • Application services are deployed in private subnets, and the database is deployed in isolated database subnets.
  • InsurOps workflows execute on Appian Cloud, connected over AWS PrivateLink.

Encryption and secrets

  • TLS protects data in transit.
  • AWS KMS encrypts the database at rest, and source documents are encrypted in Amazon S3.
  • AWS Secrets Manager stores service credentials.

Identity and access

  • Auth0 by Okta provides SAML and OIDC single sign-on and SCIM provisioning.
  • More than 50 least-privilege roles separate viewing, creation, review, approval and administration.
  • Approval rights are granted explicitly and are never inherited by administrators.
  • Each integration uses its own scoped credentials.

Tenant isolation

  • InsurOps applies tenant, role and record scope before every retrieval, review and export.
  • Each customer's data is isolated from every other customer's.

Auditability

  • InsurOps records approvals, corrections and changes to documents and workflows by user and time.
  • Each value shows who changed it, when and from which source document.

Monitoring

  • Continuous monitoring covers application performance, logs and health.
  • Health dashboards and alerting cover the production environment.
03Governed AI

InsurOps governs every AI result with source links and confidence scores.

Assurified's feature comparison scores InsurOps at 100% on AI and governance and the alternatives at 25% to 67%.

Source links

  • Every value links to its source document, and extracted values link to the page they came from.
  • Every Chat Agent answer cites its source document and page.

Confidence and approval

  • Extraction assigns a confidence score to every extracted value.
  • Reviewers approve low-confidence results before the record changes, and fields above 95% confidence can be approved in one step.
  • Every approval, correction and re-extraction is logged by user and time.

Model boundaries

  • Foundation-model inference on Amazon Bedrock is stateless and tenant-isolated.
  • Your data never trains shared foundation models, and Amazon Bedrock never passes it to model providers.
  • Resident Risk Analytics trains private models on your own portfolio history.

Agent and tool controls

  • Prompt-injection defenses, tenant checks and tool-level permissions protect Chat Agent and Model Context Protocol (MCP) tool access.
  • Each enabled action tool has its own permissions and approval policy.

Human review at scale

  • Selectsys provides managed human-in-the-loop review, with access limited to each assigned scope.
  • Review authority is separate from system administration.

Decision authority

  • Resident Risk Analytics supplies analysis and pricing indications.
  • The program's actuary, captive manager and carrier approve rates, funding and coverage.
04Availability

Assurified recovers service in a standby AWS region through a documented sequence.

Infrastructure is defined in code, and every change moves through test and staging before production.

Disaster recovery

  • Production is hosted in AWS US East.
  • The production database replicates in near real time to a standby region in AWS US West.
  • Assurified keeps standby application capacity and a standby load balancer in the recovery region.

Switchover

  • The recovery sequence promotes the standby database, switches DNS, starts application services and reconciles data.
  • Identity services cover both regions.

Change control

  • Terraform defines the AWS infrastructure in source control.
  • Each portal environment is paired one to one with an Appian environment across development, test, staging and production.
  • Approval and scheduled promotion govern movement between environments.
05Scalability

InsurOps sizes intake, extraction, human review, storage and delivery to each portfolio's document volume, from go-live through the policy year.

Document processing

  • InsurOps sets no page or file-size limit and splits long documents for extraction.
  • Bulk intake removes duplicate files by content hash before go-live.
  • AWS Fargate compute and Selectsys review teams are sized to your document volume.

Data tier

  • PostgreSQL stores structured records, and Amazon S3 stores document objects.
  • InsurOps delivers approved data to Snowflake or another data warehouse.

Interfaces

  • 385 MCP-compatible API endpoints across more than 60 domains connect InsurOps to other systems.
  • OAuth 2.0 and API keys authenticate every call, with rate limiting.
  • An event bus supports asynchronous messages, notifications and webhooks.
06Compliance

Customers and prospects can review the full SOC 2 Type II report under a nondisclosure agreement.

AICPA SOC for Service Organizations
07Security issues

Tell us about a vulnerability or an incident.

Send each report to Assurified with the details below.

Disclose a vulnerability

Send the affected URL or component, steps to reproduce and any supporting files.

Send a vulnerability report

Notify Assurified of a security incident

Send what happened, when it happened and the accounts or data involved.

Send an incident notice

For your security review

  • SOC 2 Type II report under a nondisclosure agreement
  • InsurOps Technical Data Sheet
  • Architecture and assurance evidence under a nondisclosure agreement

What stays the same

  • Your existing brokers, carriers and systems stay.
  • You control the data and who can access it.