Security & Data Deployment Policy

At Catastrophes.ai, security and data protection are foundational principles in building AI-native insurance infrastructure.

Insurance organizations manage highly sensitive information, including:

• Property information
• Insurance submissions
• Claims data
• Underwriting information
• Risk portfolios
• Proprietary business data.

Catastrophes.ai is designed with enterprise security, data protection, and deployment flexibility as core considerations.

This policy describes our approach to protecting customer information and supporting secure deployment models.

Catastrophes.ai follows the following security principles:

Security considerations are integrated throughout the lifecycle of our systems, including:

• System architecture
• Data processing
• AI model deployment
• Access management
• Operational monitoring.

Catastrophes.ai seeks to process only information necessary to provide intended services.

We aim to:

• Limit unnecessary data collection
• Reduce exposure of sensitive information
• Apply appropriate retention practices.

Customers maintain control over their submitted business data.

Depending on deployment requirements, customers may choose architectures that provide different levels of data control and operational ownership.

Catastrophes.ai supports flexible deployment approaches designed for different enterprise security requirements.

Customers may access Catastrophes.ai through secure cloud-hosted environments.

Cloud deployments may include:

• Managed application infrastructure
• Secure data storage
• Controlled access management
• Monitoring and operational protections.

Cloud architecture allows organizations to leverage AI capabilities without managing the complete infrastructure stack.

For organizations requiring stronger data isolation, Catastrophes.ai may support deployment within customer-controlled environments.

Private deployment options may include:

• Customer cloud environments
• Dedicated infrastructure
• Isolated enterprise environments.

Benefits may include:

• Greater data control
• Reduced external data movement
• Alignment with enterprise security requirements.

Certain enterprise customers may deploy Catastrophes.ai components within infrastructure managed by the customer.

This approach may support organizations with requirements related to:

• Internal governance
• Data residency
• Security policies
• Regulatory considerations.

Specific capabilities depend on deployment architecture and contractual agreements.

Catastrophes.ai recognizes the importance of separating customer information in enterprise insurance environments.

Security practices may include:

• Logical data separation
• Access restrictions
• Environment isolation
• Controlled data flows.

Customer information is not shared with other customers unless authorized or required by law.

Catastrophes.ai uses security practices designed to protect information during processing and transmission.

Security controls may include:

• Encryption during data transmission
• Encryption at rest where applicable
• Secure communication protocols
• Protected credential management.

Specific encryption implementations may vary depending on deployment model and customer requirements.

Insurance organizations require AI systems that can provide intelligence while protecting sensitive information.

Catastrophes.ai explores and supports privacy-enhancing approaches, including:

• Privacy-preserving inference
• Secure AI processing techniques
• Controlled model access
• Reduced exposure of sensitive data.

These technologies are designed to help organizations obtain AI capabilities while maintaining appropriate data protection controls.

Catastrophes.ai applies security considerations throughout the AI model lifecycle.

Areas of consideration include:

• Model access control
• Protection of proprietary models
• Controlled deployment
• Monitoring of model behavior
• Prevention of unauthorized usage.

Catastrophes.ai applies access management practices designed to limit unauthorized access.

Security mechanisms may include:

• Authentication controls
• Role-based access management
• Permission management
• Administrative controls.

Access privileges are designed around business requirements and operational responsibilities.

To support security and operational reliability, Catastrophes.ai may maintain monitoring capabilities including:

• System activity monitoring
• Access logs
• Security event tracking
• Operational performance monitoring.

Audit capabilities may vary depending on deployment model and contractual requirements.

For enterprise customers, Catastrophes.ai may work collaboratively on:

• Security reviews
• Deployment architecture
• Data handling requirements
• Integration requirements
• Risk assessments.

Additional security documentation may be provided under appropriate confidentiality agreements.

Catastrophes.ai may rely on third-party infrastructure and service providers to operate certain aspects of its platform.

Third-party providers may include services supporting:

• Cloud infrastructure
• Data storage
• Security operations
• Enterprise functionality.

Catastrophes.ai evaluates service providers according to applicable business and security requirements.

Catastrophes.ai maintains processes designed to identify, investigate, and respond to security incidents.

Response activities may include:

• Investigation
• Containment
• Remediation
• Customer communication where applicable.

Incident handling procedures may vary depending on the nature and scope of an event.

Catastrophes.ai retains customer information only as necessary to:

• Provide contracted services
• Maintain operational functionality
• Meet legal obligations
• Support security requirements.

Customers may establish additional retention and deletion requirements through contractual agreements.

Security requirements evolve continuously.

Catastrophes.ai monitors developments related to:

• Data protection
• AI security
• Insurance technology requirements
• Enterprise security practices.

Our security practices may evolve as technology, regulatory expectations, and customer requirements change.

Security responsibilities may be shared between Catastrophes.ai and customers depending on deployment architecture.

For example:

• Platform security
• AI system protection
• Application security
• Operational safeguards.

• User access management
• Internal security controls
• Appropriate use of generated outputs
• Compliance with organizational policies.

Specific responsibilities are defined through applicable agreements.