Security & Trust Center

LossFolio holds information contractors trust us with — their customers' names and addresses, claim details, property photos and pricing. We protect it with controls built into the platform itself, design our AI so it can help without taking control, and are open about where we are on independent certification.

LossFolio's AI doesn't just answer questions — it does real work: it orders reports, converts carrier estimates, finds missing code items and checks your edits. The goal is simple: get a contractor from a carrier's estimate to a complete, defensible scope faster, with fewer mistakes.

The same checks also make the AI a safety net for your work: it catches missing code items, lines a parser skipped and edits that don't add up before a scope reaches a carrier — the mistakes that lead to denied supplements and re-work.

An AI that can act needs firm limits. These are built into the software, not left to the model's judgment:

You approve every action

The assistant can only propose. Orders, ESX files and anything that costs money appear on a confirmation card that shows the price, and nothing happens until you confirm it. The assistant can't place an order, charge a card, issue a refund or agree to a price or discount on its own.

The numbers come from math, not the model

Quantities, totals and differences between estimates are calculated by deterministic code. The AI explains those results; it never calculates or invents them.

Every finding needs a source

A building-code finding must quote the code report word for word. Before anything becomes a finding, our software — not the AI — checks that the quote actually appears in the report, and drops it if it doesn't. A second, adversarial pass then challenges each gap (“is this really missing, or covered under another line?”) to weed out false positives.

Suggestions, never silent changes

Suggested Xactimate codes must exist in the real catalog or they're discarded, and recovered lines must appear in the source text. Neither is applied until a person accepts it.

Only the data it needs

Carrier estimate line items stay inside LossFolio; the assistant receives a short summary. The parse check sees only the few lines of text around a problem, never the whole estimate. The assistant can only see the companies your account can access.

Built to resist manipulation

Text inside documents, estimates and messages is treated as data, never as instructions. The assistant is limited to LossFolio tasks, ignores attempts to change its role or rules, and won't reveal its instructions. Prompt injection that exposes another company's data or triggers an action you didn't confirm is in scope for our bug bounty.

Consistent, bounded and fail-safe

Analysis runs with fixed, repeatable settings and structured outputs, with usage limits and file-size limits. If the AI is unavailable, the deterministic results are still returned — you never get a half-finished answer presented as complete.

Your data isn't used to train AI

Our AI provider's commercial terms don't allow it to train its models on the content we send. We don't use your data to train models either.

• Data is encrypted in transit with TLS and encrypted at rest (AES-256) by our database and storage provider.
• Each company's data is separated by row-level security in the database: every query is limited to what the signed-in person's role and company allow, so a mistake in application code can't expose another company's records.
• Report files are stored in private storage under each company's own folder and delivered through short-lived links after a permission check.
• Data is hosted in the United States, with daily backups managed by our database provider.
• Your company owns its data. On request after you leave, we delete it (billing and audit records we must keep by law excepted).

• Two-step login with an authenticator app is available to every user and required for all LossFolio staff and for every Company Admin, who manages billing and people. Once it's on, the database itself refuses access to a session that hasn't completed the second step.
• Five roles — Super Admin, Project Manager, Account Executive, Company Admin and User — each limited to what it needs. Nobody can grant a role above their own.
• Deactivating a user ends their database access immediately, even if they still have a session open.
• Passwords are stored only as secure hashes by our authentication provider. Administrators can't see or set anyone's password; people set their own through a one-time link.
• Suspended companies lose access to the app and its APIs, not just its pages.
• LossFolio staff access customer accounts only to provide support, and that access is recorded.
• Every administrative change — pricing, promo codes, organizations, users, refunds, voids and credits — is written to an append-only audit log that no one, including us, can edit or delete.

• Security headers on every page — content security policy, frame protection, no MIME sniffing, strict referrer policy and a restrictive browser-permissions policy — with HTTPS enforced by our hosting platform.
• All writes to billing, pricing and organization records go through server-side permission checks; signed-in users can't write those tables directly.
• Payment webhooks are verified by cryptographic signature, and scheduled jobs require a secret key, so neither can be triggered from outside.
• Sign-up has bot protection, the assistant is rate-limited, and uploads have size limits.
• Order and charge protections: duplicate-submit detection, idempotent card charges, and automatic account credit when a report can't be produced.
• Secrets are kept in our hosting provider's encrypted environment settings, never in code.
• A public vulnerability disclosure and bug bounty program, and a standard security.txt file.

• Releases are type-checked and run through automated test suites before they're pushed, then built and deployed by our hosting provider's pipeline.
• An automated health check runs daily — report generation, storage, integrations and whether production matches the released code — and alerts our team when anything fails.
• Third-party software dependencies are checked automatically for updates and known vulnerabilities.

Cards are entered on Stripe's secure page and stored by Stripe. We keep only the card brand and last four digits to show you which card is on file. Charges use idempotency keys so a retry can never charge twice.

If we confirm unauthorized access to customer data, we'll notify affected customers without undue delay — within 72 hours of confirming it — with what happened, what data was involved, and what we're doing about it, and we'll help you meet any notification duties of your own. To report a suspected incident, email security@rosetechhq.com.

We never sell your data or market to your customers. These providers help us run LossFolio; full details are on the Subprocessors page.

We welcome reports from security researchers and pay cash rewards for valid findings, with safe harbor for good-faith research. Read the full policy before testing.

Customers and prospects can request our security questionnaire responses, a countersigned Data Processing Addendum, or an architecture overview. Email security@rosetechhq.com.

Can LossFolio staff see my data?

Only when needed to provide or support the service, and that access is recorded in our audit log.

Can other contractors see my customers or prices?

No. Every company's data is separated in the database itself. Your Account Executive can see your account's pricing and order history to service it.

Can the AI order or charge something without me?

No. It can only prepare a confirmation card. Nothing is ordered or charged until you confirm it.

Do you sell data or use it to train AI?

No. We don't sell or share personal information, and our AI provider can't train on what we send it.

How do I turn on two-step login?

Go to your Account page and choose Set up two-step login. You'll scan a code with an authenticator app such as Google Authenticator, Microsoft Authenticator, 1Password or Authy.

What happens to my data if I leave?

Download your reports, then ask us to delete your data. We delete it within 90 days of your request, except billing and audit records we're required to keep.

How do I report a security issue?

Email security@rosetechhq.com. See our bug bounty policy.