Security & Privacy

How InsureClarity protects your data — last updated September 1, 2026

Your insurance documents are among the most sensitive information you own. This page explains the seven structural protections we've built around your data. Every claim is either verifiable by you today, backed by a published contract you can read, or clearly identified as requiring trust.

No marketing language. No vague promises. Just the engineering.

1. Your Identity Is Hidden from the AI

When your policy documents are analyzed by AI, a three-layer masking pipeline removes your personal details before the AI sees anything:

Layer 1 — Dictionary: A personalized dictionary matches known names (including variants like initials, reversed order, and titles), dates of birth, addresses, and account numbers. Policy numbers are intentionally passed through unmasked to improve extraction accuracy.
Layer 2 — Pattern detection: Rules-based scanning catches SSNs, Medicare Beneficiary Identifiers, driver's license numbers, phone numbers, street addresses, and more.
Layer 3 — AI verification: Reviews the already-masked text for any remaining identifiers. For health documents, this layer is fail-closed — if unavailable, the document is blocked rather than proceeding.

After masking, quasi-identifiers are generalized: ZIP codes become 3-digit prefixes and exact birth dates become birth year only. Your name becomes "Primary_User." Your spouse becomes "Dependent_1." The AI receives the insurance data it needs — coverage limits, deductible amounts, carrier names, 3-digit ZIP prefix, and age ranges — without ever knowing who the policyholder is.

How to verify this yourself

Every Navigator response shows a green badge with the count of personal details removed before processing.
For the list of what the AI does and doesn't see, see our AI Transparency page.

2. Your Documents Are Stored in Our Own Private Cloud

When you upload a policy document, the PDF goes directly from your browser to a private Google Cloud Storage bucket that we control. The file does not pass through InsureClarity's application servers.

Encryption at rest: AES-256, managed by Google Cloud.

Encryption in transit: TLS 1.2+ between your browser and Google Cloud Storage. The connection is direct.

File restriction: Only digital PDFs are accepted. Photos and scanned images are rejected at upload.

Time-limited access: When you view a document, your browser gets a short-lived access link that expires quickly. There is no permanent public URL.

Deletion: You can delete any document at any time. Deletion is immediate and permanent.

How to verify this yourself

Upload a test document. In your browser's developer tools (Network tab), observe the PUT request goes directly to storage.googleapis.com.
After uploading, try accessing the file URL after 5 minutes — it will fail.
Delete a document and attempt to access it again — it is gone.

3. Your Data Is Encrypted With a Key That Only Your Account Unlocks

Beyond storage-level encryption, InsureClarity adds per-user application-level encryption for sensitive data fields stored in our database — names, policy numbers, addresses, dates of birth, financial figures.

Each user's data is protected by a unique key that is itself wrapped by a master key held inside a hardware security module (Google Cloud KMS, FIPS 140-2 Level 3). The master key never leaves the HSM.

What this means: If someone obtained a copy of our database, your sensitive fields would appear as ciphertext. Without access to the HSM, the data is unreadable.

How to verify this yourself

The HSM certification (FIPS 140-2 Level 3) is independently audited — see cloud.google.com/security/compliance.
The encryption algorithm (AES-256-GCM) is the same standard used in banking and defense.

4. Our Team Sees Masked Versions of Your Data

Our administrative accounts — including the founder — see masked versions of your personal data in our application. Names appear as "J••••n", financial figures show as "$•••,•••", and policy numbers show only the last few digits.

Our system is designed so that decryption only happens when you — the authenticated user — request your own data. Every key operation is recorded in an immutable Google Cloud KMS audit trail that we cannot alter or delete. Any administrator access is logged, contractually prohibited, and insured against under our E&O/Cyber policy.

Transparency Note: Platform-Level Access

InsureClarity is built on the Base44 Enterprise platform (SOC 2 Type II, ISO 27001, GDPR compliant). Like all cloud-hosted services, the underlying infrastructure provider has technical access to the database at the platform level. We mitigate this through: (1) application-level field encryption (Section 3 above), which renders sensitive fields unreadable without our KMS keys; (2) Enterprise-tier contractual obligations including training data opt-out, SSO enforcement, IP allowlisting, and data residency controls; and (3) a 99.9% uptime SLA. We believe in disclosing this openly rather than implying zero-access where platform-level access technically exists.

How to verify this yourself

Google Cloud KMS maintains an immutable audit trail of every key operation.
Field-level encryption means even platform-level database access only yields ciphertext for sensitive fields.

5. No Training. No Retention. Enforced by Contract.

InsureClarity uses Google Cloud Vertex AI — not consumer-facing Google AI products. Vertex AI operates under a different legal framework:

Google Cloud Data Processing Addendum (CDPA)

A legally binding contract that prohibits Google from using customer data to train AI models. This is a contractual obligation subject to audit — not a setting we toggled on.

Read the CDPA

Stateless API Processing

Each analysis request is a single API call. Vertex AI processes the masked text, returns the result, and does not retain the input or output. No conversation history, no session memory.

How to verify this yourself

The CDPA is a public document. You can read it at the link above and verify the no-training clause yourself.
Google Cloud's SOC 2 Type II and ISO 27001 compliance is independently audited annually.

6. Every Data Access Is Recorded

Every time your sensitive information is accessed — by you, by AI, or by any system process — a detailed record is created. These records capture what was accessed, when, by which feature, and whether the data was masked first.

You can view a summary of your own access log at any time in Account Settings.

How to verify this yourself

Go to Account Settings and open "Your Data Access Log" to see a timestamped list of every data access.
Try uploading a document or running an analysis, then check the log — you'll see the new entry immediately.

7. You're In Control

Download all your data — get a complete copy of everything we store, anytime, in Account Settings.

Delete everything permanently — one action deletes all policies, conversations, profile data, analysis results, encryption keys, and security records. Immediate and irreversible.

Two-factor authentication — a verification code is required from every new device. Not optional.

Withdraw consent anytime — revoke health data processing permission in Settings, which immediately stops all AI processing of your health insurance documents.

How to verify this yourself

Go to Account Settings and click "Download All Data" to get your complete export.
Try signing in from a new device — you'll be required to verify before accessing the app.

What You Can Verify Right Now

We organize our security claims into three tiers of verifiability.

Tier 1 — Verify Yourself

Upload a test document and watch the network traffic — the PDF goes directly to Google Cloud Storage
Check the Navigator's green badge for the masking count on every response
View your data access log in Account Settings
Download all your data or delete your account and confirm it's gone
Verify MFA is enforced on every new device

Tier 2 — Verified by Contract or Certification

No-training guarantee: Google Cloud CDPA — published contract
HSM certification: FIPS 140-2 Level 3 — Google compliance page
Infrastructure security: SOC 2 Type II and ISO 27001 — independently audited annually
Professional liability: Technology Professional Liability and Cyber Insurance (underwritten by Certain Underwriters at Lloyd's, London) — coverage details in Terms of Service
Payment security: Stripe PCI DSS Level 1

Tier 3 — Requires Trust

That PII masking runs before every AI call. The masking is deterministic, and the no-training CDPA provides a backstop even if masking fails.
That administrators follow access policies. Field encryption + KMS audit trail make unauthorized access detectable and logged.
That we don't sell your data. Our only revenue is $37/year memberships. No ad revenue, no tracking pixels, no data broker relationships.

For Regulators & Consumer Advocates

What InsureClarity is: A consumer insurance education and document literacy platform. Users upload their own policy PDFs. Our AI translates them into plain language — explaining coverage, deductibles, and surfacing discoveries their broker or carrier can address.

What InsureClarity is not: We are not a licensed insurance producer, agent, broker, adjuster, premium auditor, CPA, fiduciary, or consultant in any state. We do not sell, bind, underwrite, or adjudicate insurance. Our AI says "your policy states..." — never "you're covered."

Health data compliance: We maintain a standalone Consumer Health Data Privacy Policy per the Washington My Health My Data Act (RCW 19.373). Separate opt-in consent is required and server-enforced for health document processing. Rights are extended to all users regardless of state.

State privacy law compliance: We honor CCPA/CPRA, Virginia CDPA, Colorado CPA, and Connecticut CTDPA rights — access, correction, deletion, portability, and opt-out of sale (we never sell data). All rights are available via self-service tools with a 45-day response commitment.

Accountability: Technology Professional Liability and Cyber Insurance (underwritten by Certain Underwriters at Lloyd's, London), covering professional services wrongful acts, technology products liability, and data breach response. Full liability framework in Section 16 of Terms of Service.

Regulator inquiries: admin@insureclarity.ai — we welcome examination of our practices.