Security & deployment

Runs in your cloud, under your keys, with a record of every decision

InsightProofing is deployed into the brokerage’s own environment. Client policies, documents and the decision record stay there; the model is called through your own model account.

Deployment

What runs where

Runtime

API and UI

A Python (FastAPI) API and a React workbench. Production refuses to start without a configured database — there is no fallback to a development instance.

Data

PostgreSQL

One schema on the platform Postgres, versioned with Alembic migrations. The database password is a secret reference resolved at start, never in the URL.

Documents

Object store

Documents go to the object store when one is configured and never to local disk; otherwise only their text is kept.

Models

Claude on Bedrock

Through your AWS account. Switch the agents or the copilot off and the engines’ findings stand and say so.

Access

Who sees what

Identity

One sign-in

Sign-in through the Insight identity platform with roles: account executive, account manager, practice leader, compliance.

Scope

Your own book

Account executives and managers see the checks they own or manage; practice leaders and compliance see every check. Outside scope is a 404.

Tenancy

Per organization

Every row belongs to an organization; a token for an unknown organization sees nothing.

Logs

Redacted

Every request is logged once with a correlation id; access tokens in a query string are redacted.

AI governance

Model risk, written down

Grounding

No invented numbers

Agents and copilot answer in a fixed shape citing numbered facts; an answer with a number not in its facts is thrown away; prose markers are stripped before display.

Autonomy

Capped at ask first

Every action is capped at L2. What goes to a carrier or a client, and delivering a policy, is a person’s decision.

Cost

Budgets and traces

A trace per agent step with model, tokens, cost and time; a daily budget per agent, over which the fast model answers.

Prompts

Versioned

Prompts live in the pack and in InsightPrompts, overridable without a release; every run records the prompt it used.

Testing

Tests that never call a model

Engines

Known answers

The extraction, proofing and comparison engines are pure functions tested against generated documents with known errors.

Isolation

Throwaway schemas

Tests run in their own schema on the database and drop it at the end.

No model

Refused at the client

No test calls a real model: Bedrock is refused at the AWS client in the test run.