Security & compliance
An AI you can put in front of a regulator
Insurance is a regulated business, and an AI that amends policies without leaving a legible trail is a liability with a chat interface. Auditability is not a feature we added — it shaped the product.
Encrypted in transit and at rest
TLS 1.3 on every connection. Data at rest encrypted with AES-256, with keys managed separately from the data they protect.
Least-privilege access
Role-based access control on every workspace. Integration credentials are scoped to the specific operations a flow needs, never a blanket admin token.
Data residency
Choose the region your conversations and documents live in. Enterprise deployments can run in your own cloud account.
No training on your data
Your documents and conversations serve your agents and nothing else. They are not used to train foundation models, ours or anyone else’s.
Complete audit trail
Every answer records the documents it was grounded in. Every action records the system, the record and the result. Exportable for your compliance team.
Human control points
You decide where the agent must stop and ask. Approval thresholds on payments, escalation rules on sensitive intents, hard limits on what it may never do.
Auditability
What “auditable” means here
Three specific commitments, not a posture.
Every answer is sourced
When an agent states a term of cover, the transcript records which document and section it retrieved. A reviewer can check the answer against the wording without taking anyone’s word for it — and when the citation is wrong, that is immediately obvious in a way an unsourced wrong answer never is.
Every action is logged in place
Writes into your claims, policy and booking systems appear on the conversation timeline next to what was said — not in a separate log a reviewer has to correlate by timestamp.
Uncertainty escalates
A validation pass checks each answer against what was retrieved. When the knowledge base cannot support it, the agent says so and hands to a human. It is designed to fail towards a person rather than towards a plausible guess.
Certification status
Heard is an early-stage product. We are building towards SOC 2 Type II and ISO 27001, and we are not going to claim either before an auditor has signed it. If you need a security questionnaire completed or a current controls summary for your procurement process, ask and we will send the real one.
Send us your security questionnaire
We will complete it properly and tell you plainly where we do not yet meet a requirement.