Security & Data Handling

How we handle and protect your property claim data.

A summary for your security and compliance team. Full details are available to your reviewers on request.

"Quixas checks your claims for completeness and consistency and flags exceptions with reasons. Every flag goes to your team to review and act on. It does not make coverage determinations or claims-handling decisions."

Hosting

US-region cloud

Encryption

In transit and at rest

Infrastructure

SOC 2 Type II

SOC 2 Type II infrastructure

The Service runs on cloud infrastructure holding SOC 2 Type II attestation. Data is encrypted in transit and at rest.

Tenant isolation

Claim data is isolated within tenant-specific boundaries through application-layer access controls, under least-privilege access.

Document intelligence

Document extraction runs on the Anthropic Claude API, which holds SOC 2 Type II attestation. By default, API inputs and outputs are automatically deleted from Anthropic’s systems within 30 days, and they are not used for model training. Extraction output is always checked against your deterministic ruleset; the definition of complete and consistent is your encoded rules, never a model guess.

No credentials, no writes

Quixas holds no credentials for your systems and has no write path into them. Claims reach us by a forwarding rule your IT controls and can revoke in one click, or by upload. Nothing historical moves, and nothing outside your claims intake address moves.

Human in the loop

Every flag is a reason your team can inspect. People approve, send, and decide. Quixas never contacts policyholders and never sends anything on its own.

US-region hosting

Claim data is hosted and processed in US-region cloud infrastructure.

Retention

Non-claim mailDeleted on detection, and never processed.
Claim source filesRetained 90 days from receipt, then purged.
Structured records and flag historyRetained for the life of your subscription, exportable on request, and deleted within 60 days of cancellation on written request.
Pilot dataAll pilot data is purged within 30 days of pilot close if you do not subscribe.

A current list of subprocessors that touch claim data is available to your reviewers on request.

Payments are processed by a third-party merchant of record on PCI-compliant infrastructure; Quixas never sees or stores your payment details.

Bring us your security review.

Security questionnaires: info@quixasit.com. We answer fast.

Contact Security Team