Security your review board can check for itself.
Isomer™ reads claim communications as they arrive, so it holds some of the most sensitive data in a claim. Here’s how that data is isolated, governed, and audited. We’ve built software for regulated industries before, at Fieldglass (acquired by SAP), divvyDOSE (acquired by Optum) and Catalytic (acquired by PagerDuty).
Single-tenant by default. Sovereign if you want it.
Every customer gets its own environment, so your data never touches another customer’s. For full sovereignty, Isomer also runs inside your own Azure tenant, with your keys and your models.
A dedicated tenant in our cloud
- Dedicated processing from ingestion to detection. No shared infrastructure and no commingled data.
- TLS 1.2+ in transit and AES-256 at rest.
- Private models available.
Sovereign, in your Azure tenant
- An Azure Managed Application from the Azure Marketplace, single-tenant in your tenant.
- Your keys and your models, Azure AI or open-weight. Claim data never leaves your perimeter.
- No public internet exposure, if you want none.
Your claims data serves your operation only.
No training on your data
We never train models on customer data. Our agreements with every foundation-model provider include no-training and zero-day retention terms.
Retention you set
Zero-day retention is the default for every model call. Retention and deletion of your claims data follow your policy.
Every document accounted for
Each document is logged with what was extracted from it, which detectors were evaluated, and what was done as a result.
Audited, and aligned with the rules you work under.
For carriers, TPAs, and MGAs with strict data governance requirements.
SOC 2 Type II
Audited controls across security, availability, and confidentiality, monitored continuously through Vanta.
HIPAA
Business associate agreements for claims that involve protected health information.
NAIC and NIST
Aligned with the NAIC Model Bulletin on AI Systems, adopted in 25+ states, and the NIST AI Risk Management Framework. ISO 27001 is in progress.
AI that shows its work, and a person who decides.
You stay accountable for how AI is used on your claims, even when a vendor runs it. So every finding can be checked, and every step can be reconstructed.
- Cited to the page. Every signal carries the sentence, document, and page that triggered it.
- Structured detection. Signals are evaluated against defined detector logic, not open-ended generation.
- Uncertainty goes to a person. When confidence is low, the item routes to review instead of passing silently.
- A person authorizes every state change. Isomer flags and drafts; your team decides.
- A complete record. Every model call, detector evaluation, alert, and action is logged with its time and context, and exportable for market conduct exams, regulatory filings, and internal review.
You choose the access level.
We don’t need admin access to your systems. You set the connection and the permissions.
Scoped, revocable inbox access
OAuth 2.0 consent to the claims mailboxes in Microsoft 365 or Google Workspace. Token-based, with no passwords stored, and revocable at any time.
Read-only to start
Detection needs read-only access. Isomer never sends, changes, or deletes your mail. Writing notes and tasks to your claim system is optional.
Locked-down APIs
API keys with permissions scoped per endpoint, and IP allowlisting for programmatic access.
Bring us your security review.
Thirty minutes with our team and your reviewer on architecture, controls, and documentation.
