1. Your data is safe

We protect your information with industry-standard controls:

• Encrypted in transit: all traffic uses TLS (HTTPS).
• Encrypted at rest: every uploaded document is encrypted with AES-256-GCM envelope encryption; the encryption keys are held as a host secret, never alongside your files.
• Isolated environment: the pilot runs in a dedicated, access-controlled tenant separate from any other system.
• Credentials: passwords are stored only as salted one-way hashes — never in plain text.
• Access logging: access to documents and authentication data is logged.

2. How your data is processed

When you run an analysis: you upload two documents → they are stored encrypted → an AI model reads them to identify required vs. held coverage and checks the relevant statutes → you receive a plain-English coverage report with citations. Documents are read only during the analysis and are not re-read afterward. The result is stored so you can return to it, then deleted per the retention policy below.

3. PII protection in AI use

• Your documents are processed by Claude (Anthropic) solely to perform your analysis.
• The AI is constrained to use only the documents you provide and cited public law; it is instructed never to invent policy facts or legal claims (a "no citation, no claim" rule).
• Your documents and personal data are not used to train AI models, consistent with the AI provider's commercial terms.
• Data is minimized, encrypted, and access-restricted throughout processing.

4. What data we collect for the analysis

• The two documents you upload — the contract that imposes insurance requirements and your current insurance policy (e.g. ACORD 25, declarations page).
• Your account profile: name, email, company, and phone (imported from InsurEco).

This data is used solely to produce your coverage analysis and Q&A answers.

5. What we collect to evaluate & improve the pilot

To measure the pilot and improve the product, we record aggregated, de-identified usage metrics — for example: whether an analysis completed, how long it took, which actions you took (report downloaded/emailed), which legal sources were cited, and optional satisfaction feedback. The content of your documents is never used for analytics.

6. Where your data is stored

Your data is stored in a dedicated, isolated, access-controlled environment operated by Speednet on behalf of InsurEco for the duration of the pilot. The hosting region and any cross-border processing are governed by the Data Processing Agreement (DPA) between Speednet and InsurEco. Uploaded documents are stored encrypted at rest.

7. Confidentiality

Your documents, analyses, and Q&A are treated as confidential. Access is restricted to the minimum necessary to operate the service and is logged. We do not sell your data, and we do not share it with third parties except the sub-processors required to run the service (e.g. the AI provider) under contractual confidentiality and security obligations.

8. Data retention & deletion

Documents and results are retained for the pilot plus a short grace window. If the pilot is not continued, all uploaded documents and results are hard-deleted within 30 days of pilot close, and a deletion certificate can be provided to InsurEco. You may request deletion of your data at any time (see §11).

9. Fair & ethical use

• Only upload documents you are authorized to share.
• Use the outputs as decision-support to take to your broker, HR, or attorney — not as a substitute for professional advice.
• Do not attempt to misuse the service, extract other users' data, or use it for unlawful purposes.

10. Out-of-scope use

• Not legal or insurance advice, and not a substitute for a licensed professional.
• Legal grounding currently covers New York, California, and U.S. federal law only.
• It covers statutes and regulations as of a fixed snapshot date — not case law, and not the most recent amendments. The "as-of" date is shown with legal results.
• Out-of-scope questions are declined rather than answered with a guess.
• Do not rely on the outputs as your sole basis for legal, financial, or coverage decisions.

11. Your rights

Depending on your state, you may have rights to access or delete your personal data — including under the California Consumer Privacy Act (CCPA/CPRA) and the New York SHIELD Act. Requests are handled per the DPA; contact InsurEco or the pilot operator to exercise them.

12. Liability

The service is provided "as is" for informational and decision-support purposes during the pilot. To the maximum extent permitted by law, InsurEco and Speednet are not liable for any decision or action taken in reliance on the outputs. Always verify coverage and legal questions with a qualified professional.

13. Contact

For data requests, security questions, or to report an issue, contact your InsurEco pilot representative. This is a beta program (July 2026) and these terms may be updated during the pilot.