Hosting
HONESTAS runs in one of two places, with the same software in both.
- Our EU cloud. Data centres in Ireland. Your data is stored and processed in the European Union, and you choose where each kind of data is kept: our EU cloud or your own data centre.
- Your own data centre. HONESTAS installed on your own hardware, behind your own network controls. Updates arrive as signed packages that you approve before they run.
In both, sealed records are written to a record store outside the installation, with an outside time stamp, so a compromise of one installation cannot rewrite its history.
Encryption and keys
- Data is encrypted in transit and at rest, with a separate key for each firm.
- You can hold your own keys in your own key store. Withdraw the key and the data it protects can no longer be read.
- The keys that seal records are kept apart from the keys that protect data, and are never available to the people who sign decisions.
- AI calls run on your own model provider accounts and keys, under your own contracts. Each call is recorded with the key, the model and the version used.
- Card numbers never reach HONESTAS. Customers type them into the payment provider's own fields.
Isolation
Every request in HONESTAS names three things: the firm it belongs to, whose data it is and the unit asking. A request that cannot name all three is refused with the code SCOPE_REFUSED, and the refusal is recorded.
- Between firms. Each insurer, broker, MGA or TPA has its own space and its own keys. In a shared placing room, the wall between markets is checked before every message is sent.
- Between owners. A TPA or broker working for many clients keeps each client's records under that client's name.
- Between units. Teams such as the special investigations unit can be walled inside one firm.
Every uploaded file is opened in a sandbox with no network access, read, and thrown away.
Access
- People sign in through your own identity provider over SAML or OIDC, with accounts kept in step over SCIM. Signatures on decisions use passkeys on the person's own device.
- Roles decide what each person may see and do. Risky changes, such as a new authority limit or a new model version, wait for a second person.
- In an emergency, an administrator can be given full access for a short time, with a second person watching and every step recorded.
- Access by Adverant staff is limited, approved and recorded.
Logging
Every sign-in, read, change, AI call and administrator action is logged with who, what, when and from where. Logs are kept outside your installation, cannot be edited, and are kept for the period you set. You can send them to your own security tools through the events API.
Testing
- Independent testers test HONESTAS for weaknesses. We fix findings in order of severity.
- Every build is signed, and the software it contains is checked for known weaknesses before it ships.
- The checks that refuse decisions, the seal and the walls between firms are tested on every release.
Incidents
If an incident affects your data, we tell your named security contact without undue delay and follow the plan in your agreement. We give you a timeline from the first alert and the facts you need to meet your own reporting duties under DORA and GDPR.
Report an issue
Email security@honestas.ai. Please include:
- what you found and where (the address, screen or component);
- the steps to reproduce it, with any proof-of-concept code or screenshots;
- what an attacker could do with it, as you see it;
- how to reach you, and whether you would like to be credited.
Write in English if you can. One clear report is more useful than several short ones. Please do not include personal data you came across; describe it instead. We fix the most serious issues first, tell you when the fix is out, and agree with you when the details can be shared.
What is in scope
- honestas.ai and its subdomains, including the HONESTAS console;
- HONESTAS as we run it in our EU cloud, including sign-in, the record store and the record verifier;
- the HONESTAS apps for iOS and Android, the storefront SDK and the public API.
Out of scope: attacks on our people (phishing, social engineering), physical attacks, denial of service, findings that need an already compromised device, and reports from automated scanners without a demonstrated impact. An installation in a customer's own data centre belongs to that customer; please report issues there to them as well as to us.
Rules for researchers
- Use only accounts and data that are yours, or that you were given for testing.
- Do the least needed to prove the issue. Stop and tell us as soon as you reach another firm's data.
- Do not change or delete data, degrade service, or keep access longer than needed.
- Keep the details private until we have agreed a disclosure date.
Safe harbour
If you act in good faith and follow these rules, we will treat your research as authorised. We will not take legal action against you or report you to the authorities for it, and if someone else does, we will make it clear that you acted with our permission. This does not cover actions that break the law in ways these rules cannot authorise.
Disclosure
We prefer to publish details after a fix is available to everyone who needs it. We will agree the timing with you, and we will not ask you to stay silent for longer than it takes to protect our customers. If we disagree, we will tell you why.
If you are a customer, report a suspected incident through the security contact in your agreement or through support inside HONESTAS, so we can follow your incident plan. For where your data lives and the rules we map, visit the trust centre.
Last updated 23 October 2026