Ishqkala handles claim files that contain policyholder information, adverse party details and bodily injury medical records for US insurers, TPAs and self-insured entities. This policy summarizes the controls that protect that data and explains how security researchers can report a vulnerability to us in good faith, with a clear safe harbor.
Security program
Our security program is led by Priya Venkatesh, CISSP, Head of Security and Compliance, and is audited annually by an independent CPA firm under SOC 2 Type II. Policies are reviewed at least once a year. Administrative, physical and technical safeguards follow the HIPAA Security Rule for every claim file, and our vendor documentation is built to help customers meet third-party service provider requirements such as 23 NYCRR 500.11 and state insurance data security laws based on the NAIC Insurance Data Security Model Law.
Data protection and tenant isolation
Customer data is encrypted at rest with AES-256 using AWS Key Management Service, with a separate key hierarchy for each customer tenant, and in transit with TLS 1.3. Claim data is stored and processed only in AWS US regions, and customers may elect AWS GovCloud (US). Each tenant's data sits in separate storage locations, and tenant boundaries are enforced at the database layer as well as in the application.
Ishqkala never trains AI models on customer claim files or adjuster notes. Model inference runs inside Ishqkala-controlled AWS accounts in US regions, and no third-party model provider receives customer data.
Access control and personnel
Customer users sign in through SAML 2.0 or OpenID Connect single sign-on, or with multi-factor authentication. Roles limit each user to the claims and functions their job requires. Ishqkala staff reach production only through just-in-time access approved per session, time-limited and fully logged, from hardened virtual workspaces in the same US region as the data. Access rights are reviewed quarterly.
Every employee and contractor completes a background check before receiving access, plus security and HIPAA training at hire and every year after.
Application and infrastructure security
Code changes require peer review and pass static analysis, dependency scanning and secret detection before deployment. Infrastructure is defined as code and reviewed like application code. An independent firm performs a penetration test at least once a year and after major architecture changes; customers can review the summary report under NDA. We remediate confirmed critical vulnerabilities within 7 days, high within 30 days and medium within 90 days.
Monitoring, incident response and continuity
Security and system logs are centralized and monitored around the clock, with on-call engineers paged on alerts. Our incident response plan is exercised in tabletop tests twice a year. Customers are notified of security incidents affecting their data within the timelines in their Data Processing Addendum and Business Associate Agreement.
Production runs across multiple AWS Availability Zones with encrypted daily backups and point-in-time database recovery. We target a recovery point objective of one hour and a recovery time objective of eight hours, and test restoration every year.
Reporting a vulnerability
Email security@ishqkala.si with a description of the issue, the affected URL or component, step-by-step reproduction instructions, the impact you observed and any proof-of-concept code. If you need to send sensitive details, ask for our current PGP key in your first message.
In scope: www.ishqkala.si, app.ishqkala.si and api.ishqkala.si. Out of scope: denial of service testing, social engineering or phishing of our staff, physical attacks on offices or data centers, vulnerabilities in third-party services we use (please report those to the vendor), automated scanner output without a demonstrated impact, and missing headers or email authentication settings without a working exploit.
Rules of engagement
Test only against accounts you own or a test tenant we provide on request. Never access, modify, download or keep customer data. If you encounter claim data, medical records or any other personal information, stop testing, do not save or share it, and report it to us immediately. Do not degrade service for other users. Give us 90 days to fix an issue before disclosing it publicly, and do not make demands for payment as a condition of disclosure.
Our commitments to researchers
We will acknowledge your report within two business days, share an initial assessment within five business days, and update you at least every 14 days until the issue is resolved. We will tell you when a fix is deployed and, with your permission, credit you on our security acknowledgments page. We do not currently run a paid bug bounty.
Safe harbor
If you make a good-faith effort to follow this policy, we will consider your research authorized. We will not pursue civil action or refer you to law enforcement, and we will not bring claims under the Computer Fraud and Abuse Act or the anti-circumvention provisions of the Digital Millennium Copyright Act for that research. We waive restrictions in our Terms of Service that would otherwise prohibit it. If a third party takes legal action against you for research that followed this policy, we will make it known that your activity was authorized.
Safe harbor does not cover activity that intentionally accesses customer data beyond what is needed to demonstrate a vulnerability, or that breaks applicable law.
Security documentation for customers
Customers and prospects can request our SOC 2 Type II report, penetration test summary, completed SIG or CAIQ questionnaire, HIPAA risk analysis summary and data flow diagrams under NDA through the Trust Center or at security@ishqkala.si.