Role-based access
Sessions are scoped to role-based workspaces — from the actuarial and finance desks to the cedent portal. Operations outside the role are designed to be refused, not hidden.
Trust & security
Say what the controls are. Say what they are not.
A platform that exists to carry evidence should describe its own posture the same way — plainly, including the parts still in front of us.
Segregation of duties
Where terms or money move, the workflow requires different people to make and to check. The separation is enforced by the system and visible in the record.
Append-only audit trail
State changes are recorded with author, timestamp and reason. Adjustments never overwrite — they annotate, and the annotation travels with the figure.
Tenant isolation
Records are scoped to their tenant by design, with queries carrying that scope at the data layer, so cedent portal users see their own treaties and nothing else.
Personal-data handling
Personal data is minimised, flagged where it appears, and access to it is role-gated and logged. The demonstration environment contains fictional people only.
Transport & secrets
Traffic is encrypted in transit, and credentials and connection secrets are kept in managed environment configuration rather than in code or exports. Walk the boundary with us and test it yourself.
Hosting & outsourcing diligence
The preview environment runs on managed cloud infrastructure (Vercel and Neon, on AWS US regions), with encryption at rest and tenant-scoped data. If your domicile's outsourcing guidance — BMA or CIMA — requires you to gather vendor due-diligence answers on continuity, recovery and audit access, we answer them directly in the working session rather than behind a portal.
Stated plainly.
- Certifications. TreatyWorks has not yet completed an independent controls certification (such as SOC 2 or ISO 27001). The controls above describe how the platform is built, not a third-party attestation. Certification is on our roadmap and we will state the scope when we have it.
- Regulatory status. TreatyWorks is software. It is not a regulated entity, and nothing it produces is a regulatory filing, an actuarial opinion or professional advice. Capital and solvency screens in the demonstration environment are illustrative and labelled as such.
- Demonstration data. The demo environment runs Meridian Re, a fictional reinsurer. Its people, cedents, treaties and figures are invented; any resemblance to real parties is coincidental.
Questions about our posture, or need a deeper security conversation for an evaluation? Contact us. See also the disclaimer and privacy notice.