Skip to content
Ishqkala

Security & compliance

Claim files hold medical records, SSNs and adverse party data. We treat them that way.

SOC 2 Type II, HIPAA BAAs, US-only residency, and a hard rule: your claim files never train a model.

Visit the Trust Center Contact security
SOC 2 Type II
HIPAA + BAA
ISO 27001 aligned
AES-256 / TLS 1.3
US-only residency
Zero model training

Controls

Ten controls carriers ask about first.

  • SOC 2 Type IIAnnual independent audit of security, availability and confidentiality controls. Report available under NDA.
  • HIPAA and Business Associate AgreementsSigned BAA for bodily injury, med-pay and workers' comp files that contain protected health information.
  • AES-256 at rest, TLS 1.3 in transitEncryption everywhere, with customer-managed AWS KMS keys available on Enterprise.
  • Zero AI model trainingClaim files, adjuster notes and findings are never used to train or fine-tune any model, ours or a vendor's.
  • Multi-tenant isolationPer-tenant encryption keys, logically segregated storage and row-level access enforcement on every query.
  • US-only data residencyClaim data stays in US AWS regions, with an AWS GovCloud deployment option for public-entity programs.
  • SSO, MFA and RBACSAML 2.0 SSO, SCIM provisioning, enforced MFA and role-based access down to client program and line of business.
  • Immutable audit logsEvery view, export, decision and write-back is logged with user, time and source and retained for seven years.
  • Penetration testingAnnual third-party penetration tests plus continuous scanning. Summaries and remediation status shared under NDA.
  • Least-privilege integrationsRead-only service accounts by default; write-back limited to Activities, Notes and subrogation flags you approve.

Data flow

From your claims system to your tenant, and nowhere else.

Connections are initiated from your side or through customer-provisioned service accounts. Processing and storage stay inside your tenant boundary in a US region.
  1. 1Your claims systemRead-only service account or PGP-encrypted SFTP
  2. 2TLS 1.3 transportMutual TLS available for API connections
  3. 3Your Ishqkala tenantIsolated storage, per-tenant keys, US region
  4. 4Models run in-tenantNo training, no retention by any model vendor
  5. 5Write-back or exportOnly the objects you approve, fully logged
Security policy & responsible disclosure Subprocessors Business Associate Agreement

FAQ

Security FAQ

Claim header fields, loss date and state, payments, diary notes and attached documents. Policyholder identifiers can be tokenized or removed for audits; Ishqkala does not need Social Security numbers to find subrogation.

In US AWS regions only. Engineering staff in India access production through US-hosted, audited workspaces, and no claim data is stored in India.

Never. Claim numbers, claimant names, VINs, insured details and settlement amounts are excluded from every client-side analytics and tracking script by design.

Request them through the Trust Center. We share them under NDA, typically the same business day.

Find the millions hiding in your closed claim files before the Statute of Limitations expires.

We'll scan a batch of 500 closed claims for free and deliver an itemized recovery manifest within 5 business days.

Request a free closed-claim audit Start 14-day free trial