SOC 2 Type 2
Examined by an independent CPA firm.
Encryption
Encrypted in transit and at rest.
Human-in-the-Loop
Human oversight on high-risk decisions.
NAIC AI Model Bulletin
Aligned, Compliance-by-Design.
SECURITY POSTURE
Security controls across every layer
How we protect your data day to day. Each control is published, and kept current, on our Trust Center.
Data Protection & Encryption
Your data is encrypted in transit and at rest. Encryption is enforced on end-user devices alongside mobile device management and anti-malware.
Access Controls
Multi-factor authentication for administrative and critical access, least-privilege permissions, regular access reviews, and enforced onboarding and offboarding.
Monitoring & Incident Response
Audit logs are collected and managed under a documented incident response policy, with an established breach notification process.
Backup & Recovery
Automated backups, a documented business continuity and disaster recovery policy, and an established data recovery process keep your Digital Workforce running.
Your Data Stays Yours
Personal Identifying Information is never stored as a reference for LLM training, and data can be removed from storage on request. Your data is yours.
Infrastructure & Change Control
Cloud infrastructure sits behind a Web Application Firewall with restricted production access, automated security scanning, and pull-request-based change control.
AI GOVERNANCE
Secure data and safe AI, together
Our SOC 2 Type 2 report answers whether your data is safe with us. Human-in-the-Loop oversight and NAIC alignment answer whether the AI is safe in front of your policyholders. Indemn holds both.
Human-in-the-Loop Oversight
A foundational quality-control layer keeps your team in full control. When a situation is high-risk or ambiguous, the AI Associate queues a response for human review, producing a transparent trail of decision-making.
Compliance-by-Design
Deterministic guardrails and moment-by-moment integrity checks keep every Associate aligned with the NAIC AI Model Bulletin. Compliance is built into the architecture, not bolted on afterward.
INSURER DUE DILIGENCE
Built for your third-party risk review
Third-party risk reviews under frameworks such as NYDFS 23 NYCRR 500.11, state laws based on the NAIC Insurance Data Security Model Law, and the NAIC AI Model Bulletin commonly ask a service provider for the evidence below. Need something not listed here? Bring your questionnaire to a call.
Independent SOC 2 report
SOC 2 Type 2 report on our security controls from an independent CPA firm, issued September 2026.
Request accessPenetration testing
Independent penetration testing within the last 12 months, with every finding remediated.
Incident notification
A documented incident response policy and an established breach notification process.
Need our SOC 2 Type 2 report?
Request the report through our Trust Center, or bring your security questionnaire to a call — we will walk your team through our controls and how they map to your requirements.