Home / Security & AI governance

Security you can question.

Badges are easy to paste and hard to verify. Here is our posture, stated plainly, written for the person who has to sign off on us.

Plain text, on purpose, no badges on this page Every answer available in writing
Map your systems with us → See the AI governance model ↓
Where we stand

We hold a SOC 1 Type 1 report.

NTIS holds a SOC 1 Type 1 report, an independent auditor's opinion on the design of our controls at a point in time. Type 1 speaks to design, not to operating effectiveness over a period; we say that plainly because your carrier's reviewer will ask, and because the report itself says it. Underneath it: access is least-privilege and reviewed, data is encrypted in transit and at rest, every AI suggestion is logged with its reasoning, and a person approves anything that touches rating or binding. Your data stays yours, and the exit terms are written down.

Then you check it yourself. NTIS stands up a working system and you operate it in production for 30 days, on your own submissions. Your reviewer watches the real thing run, on real data, before the monthly rate starts. Ask us anything about this page and you get a specific answer; if the honest answer is "not yet," that is the answer you get.

During diligence

What every buyer gets to review.

Three things, provided in every Assessment and available on request, before the 30-day production trial starts, and before you commit to anything. These sit alongside the SOC 1 Type 1 report, not in place of it.

The written security-practices document

Our controls in plain language, one document your reviewer can mark up:

  • Access control and least privilege
  • Encryption in transit and at rest
  • Backup and recovery posture
  • Hosting, monitoring, and vendor management
  • Incident response, with a named contact

The architecture walkthrough

A live working session between our senior lead and your technical reviewer: how data flows, where it lives, who can touch it, and what happens when something fails. Not a slide export. Questions welcome, anything we can't answer in the room leaves as a written follow-up, not a shrug.

The AI governance package

The AI-use policy, the provider inventory, and the approval-and-logging model, the paperwork your carrier's reviewer will ask about first, ready before they ask.

See the model below ↓

None of this requires a meeting to request. Email contact@newtecinsurance.com and ask for the review package.

AI governance

Our working policy: a person approves anything that touches rating or binding.

Not an aspiration, the operating rule behind every assist we ship. The AI Operational Workforce takes the mundane, repeated work: reading the submission, proposing Classifications and data, ranking them with reasoning. Your underwriter decides. Every suggestion, decision and outcome is logged, providers are inventoried and disclosed per engagement, and an AI-use policy ships with every engagement, so your file has the answer before anyone asks.

SHIPS WITH EVERY ENGAGEMENT

The paperwork you hand your carrier

Short on time? Send them our carrier brief, one page, written for a reviewer, no login.

  • An AI-use policy specific to your engagement, what the assists do, and what only people do
  • A provider inventory, which models and services touch your data, disclosed per engagement
  • The approval model, in writing, suggestion logs with reasoning, human sign-off, reviewable trail
WHY IT'S BUILT THIS WAY

Regulators look through vendors

This model is aligned with the NAIC model bulletin, adopted by 24 states and the District of Columbia as of July 2026. Your carriers answer to regulators, regulators look through vendors, so your paperwork needs us to have paperwork. Ours is written before the first suggestion is ever made, not assembled after the first questionnaire arrives.

The same trail covers iO, our execution agent, in production since August 2026: every action records the suggestion, the document field each value came from, the underwriter who approved it, and the quote number it produced, held in your Core system and exportable on request. How the iO intelligence layer is governed

Straight answers

The five questions a reviewer always asks.

These arrive in every questionnaire. Here they are answered before you have to send one.

We hold a SOC 1 Type 1 report, which is an independent auditor's opinion on the design of our controls at a point in time. Type 1 speaks to design, not to operating effectiveness over a period, and we say so plainly because your reviewer will ask and because the report says it. We do not hold a Type 2 report and we do not claim one.
In cloud infrastructure we name for you in writing during diligence, with access on a least-privilege basis and reviewed. Data is encrypted in transit and at rest. The list of who on our side can reach a given environment, and why, is part of the security review package.
It leaves with you, in an open format, on request. There is no clause that makes your data contingent on an invoice, a notice period or a renewal. The exit terms are written into the agreement rather than promised on a page.
No. Anything that touches rating or binding requires a named person to approve it. Every suggestion is logged with the document field it came from, the person who approved it, and the record it produced. That log is held in your Core system and is exportable.
Yes to both. Send the questionnaire and we answer it in your format, including the questions where the answer is that we do not do that yet. Testing scope and timing are agreed in writing first, as they would be with any system you run.
Data ownership

Your data is yours.

Not "yours once the invoice clears." Not "yours in a format only we can read." Yours, and the exit terms are written down before the engagement starts, when you have all the leverage.

  • Yours. There is no clause where the state of the relationship changes who owns the book.
  • Exportable formats, documented structures, exports your next vendor can actually load, with the schema written down.
  • No exit penalty, leaving is a process, not a negotiation.
  • Deletion on request, at engagement end we delete what you ask us to delete, and confirm it in writing.
Illustrative interface, sample data
Full data export deliveredComplete
Schema documentation includedComplete
Producer accounts & permissions handed offIn progress
Access revoked, confirmed to clientScheduled
Deletion of retained copiesOn your written request
Illustrative exit checklist, sample data. The exit process is written into your agreement.

Bring your hardest security question to the mapping session.

Sixty to ninety minutes, free, with the people who run the systems. If the honest answer is “we don’t do that yet,” that is the answer you will get, in the first meeting.

Map your systems with us → Get the MGA Systems Assessment Send us your security questionnaire

Speak with us on your security and data protection concerns.