Security and compliance
Insurance data security for loss runs
LossRunReports encrypts every loss run in transit and at rest, encrypts FEINs and claimant names at field level, limits access by role, records every view and export in an audit log and deletes documents on the retention schedule you set. Your documents are never used to train AI models.
What we protect and how
Loss runs are nonpublic personal information under the GLBA Safeguards Rule when they identify claimants. These are the controls in the product today.
Encryption in transit
Every connection uses TLS 1.2 or higher. Plain HTTP is redirected.
Encryption at rest
Documents and database backups are stored encrypted. FEIN and claimant name fields carry an additional application-level encryption layer.
Role-based access
Admin, manager, account manager and viewer. Accounts can be assigned so staff see only their book.
Audit log
Each document view, download, export and request is recorded with user, time and IP address. Enterprise plans export the log.
Retention you control
Choose 30 days to 7 years per agency. Documents past retention are deleted automatically. Legal hold pauses deletion for an account.
No training on your data
Documents, claims and summaries are never used to train AI models, ours or anyone else's.
Single sign-on
SAML, Google and Microsoft sign-in on Enterprise, with user provisioning by CSV.
Tenant isolation
Every record is scoped to one agency. Queries without an agency scope are rejected in code.
Anonymous demo deletes the file
A file uploaded to the public demo is deleted right after it is read. Only the extracted result is kept, for that browser.
GLBA, GDPR and state privacy laws
We do not claim certifications we do not hold. Here is what LossRunReports supports and what stays with your agency.
GLBA Safeguards Rule
The FTC Safeguards Rule requires financial institutions, which includes insurance agencies, to oversee service providers that handle customer information. LossRunReports gives you the evidence for that oversight: encryption, access control, audit trail, retention and a written security overview. It is built to support your GLBA Safeguards program, not to replace it.
GDPR, CCPA and state laws
A data processing agreement is available self-serve, deletion requests are handled from the account, and personal data is processed only to deliver the service. State insurance data security laws modeled on the NAIC Insurance Data Security Model Law expect vendor oversight; the same documentation applies.
Security questions brokers ask
Where are documents stored?
Documents are stored in encrypted storage in the United States on infrastructure operated by our hosting provider, with daily encrypted backups.
Who at LossRunReports can see our files?
Nobody browses customer files. Support access happens only when you ask for help on a specific document, and that access is logged.
Can we delete everything?
Yes. Delete an account or the whole agency from settings, or set a short retention period. Deleted documents are removed from storage and from the next backup cycle.
Do you sign a DPA?
Yes, the data processing agreement is available on the DPA page and applies to every plan.
Is there a security questionnaire?
Enterprise customers download a completed questionnaire from the dashboard. For other plans, write to [email protected].
See your own loss run read in under a minute
Upload one carrier report or use our sample. No account needed for the first read.