Privacy Policy

This Privacy Policy applies to:

• Visitors to our website at allegoryos.com
• Personnel of organizations that access or evaluate the AllegoryOS platform ("Client Users")
• Information processed by AllegoryOS on behalf of our enterprise clients in the course of delivering contracted services

AllegoryOS is an enterprise software platform built for insurance carriers, managing general agents, and underwriting teams. It is not a consumer product.

If you are an individual whose personal information is processed through AllegoryOS by an organization that uses our platform — for example, as part of an insurance submission or underwriting workflow — that organization is the data controller responsible for your information under applicable law. Please direct privacy inquiries to that organization in the first instance. Allegory will cooperate with clients to support the fulfilment of your rights within the capabilities of the platform.

Allegory Technology Inc. is incorporated under the laws of Ontario. We are the developer and operator of AllegoryOS, a managed cloud infrastructure and software platform purpose-built for insurance operations, including quote management, product and pricing administration, document generation, and AI-assisted underwriting workflows.

Privacy inquiries: privacy@allegoryos.com

Understanding how Allegory handles personal information requires understanding two distinct roles we occupy, depending on context.

3.1 Data Controller

Allegory acts as a data controller in respect of:

• Information collected from visitors to allegoryos.com
• Account and contact information of Client Users (personnel of our enterprise clients who access the platform)
• Information exchanged during business development, sales, and support activities
• Operational and administrative records relating to our own business

As controller, Allegory determines the purposes and means of processing and is directly responsible to individuals for the handling of their information under this Privacy Policy.

3.2 Data Processor

Allegory acts as a data processor in respect of:

• All data, documents, and information that our enterprise clients upload, submit, or generate within their dedicated Client Environment on AllegoryOS

When we act as a processor, our enterprise client is the data controller. Allegory processes client data solely on the documented instructions of the client and in accordance with the data handling terms in the applicable client agreement, including the Statement of Work and its appendices. We do not determine the purposes of processing in that capacity, and this Privacy Policy does not govern client data — the applicable client agreement governs those obligations directly.

If you are an individual whose personal information is contained in data submitted by an Allegory client, please contact the organization that submitted your information. Allegory will cooperate with that client to support the fulfilment of your rights.

4.1 Information We Collect as Controller

Website Visitors

When you visit allegoryos.com, we automatically collect:

• Device information: browser type, operating system, user agent, device identifiers
• Usage data: pages viewed, navigation patterns, time spent on the platform, click patterns
• IP address: for security purposes and regional data routing
• Log data: server logs, error reports, and system diagnostics

Client Users (Platform Access)

When personnel of our enterprise clients access the AllegoryOS platform, we collect:

• Contact information: name, email address, and phone number provided during account provisioning
• Authentication data: credentials managed through our identity layer (AWS Cognito); passwords are hashed and are never stored in plaintext
• Access logs: login events, session activity, and platform usage attributable to named user accounts
• Communications: support requests, correspondence, and feedback provided to our team

Business Development and Sales

When you contact us, request a demonstration, or engage with us about AllegoryOS services, we collect:

• Contact information you provide (name, job title, email address, phone number, organization name)
• Information exchanged during calls, meetings, or email correspondence

4.2 Client Data Processed as Processor

When our enterprise clients use AllegoryOS, they submit data to their dedicated Client Environment. Depending on the nature of the engagement, this data may include:

• Insurance submission documents (broker applications, loss runs, financial statements, and supporting materials)
• Underwriting inputs, rating parameters, and pricing outputs
• Personal information of business representatives contained within submission packages
• Quote documents, policy outputs, and workflow records generated within the platform

Allegory processes this data solely to deliver the contracted services. We do not collect or use this data for any purpose beyond service delivery, and we do not apply this Privacy Policy to it — the applicable client agreement governs. The categories and purposes of processing for each client engagement are documented in the relevant Statement of Work.

In our capacity as data controller, we use information we collect to:

• Operate and deliver the platform: provision Client Environments, authenticate users, maintain platform availability, and deliver contracted services
• Communicate with clients and prospects: respond to inquiries, provide service updates, deliver onboarding support, and manage client relationships
• Secure the platform: detect threats, prevent unauthorized access, investigate incidents, maintain audit trails, and meet our contractual security obligations to clients
• Improve our platform: analyze usage patterns and operational data to improve AllegoryOS functionality, reliability, and performance
• Meet legal obligations: retain records required by applicable law, respond to lawful requests from regulators or courts, and maintain compliance with PIPEDA and Quebec Law 25
• Manage our business: invoicing, contract administration, vendor management, and internal business operations

Allegory processes personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25).

Our processing activities and corresponding legal bases are:

Where we rely on legitimate interests, we have assessed that those interests do not override the rights and reasonable expectations of the individuals concerned, having regard to the B2B enterprise context in which AllegoryOS operates. Data subjects in this context are primarily business professionals acting in a commercial capacity.

AllegoryOS uses artificial intelligence to assist insurance operations, including document parsing and underwriting workflow automation. This section explains precisely how AI is deployed and how we protect information throughout that process.

7.1 AI Models in Use

AllegoryOS uses Anthropic Claude Sonnet 4 and Claude Opus 4, accessed via Anthropic's commercial Messages API. These are the only foundational AI models used to process client data within the platform. Model selection within the Claude 4 series is determined by Allegory based on task requirements, performance characteristics, and cost efficiency. Allegory reserves the right to substitute or upgrade foundational models where the substitution delivers equivalent or superior capability, does not materially degrade output quality, does not compromise client data handling requirements, and is preceded by reasonable written notice to the applicable client.

7.2 Zero Data Retention

Allegory accesses Anthropic's models using commercial API credentials subject to Anthropic's Zero Data Retention (ZDR) policy. Under this policy:

• Prompt inputs — including any document content or personal information submitted for parsing — are not retained by Anthropic after the API response is returned
• Model outputs are not stored by Anthropic following completion of the API call
• Client data processed through the AI layer is effectively deleted at the provider level immediately upon response completion

Allegory maintains ZDR-eligible API endpoints and commercial credentials throughout all client engagements. Allegory will not route client data through non-ZDR-eligible Anthropic products or interfaces without the client's prior written consent.

Allegory will notify affected clients promptly if Anthropic modifies its Zero Data Retention policy in a manner that materially affects the protections described in this section.

7.3 No Autonomous Decision-Making

AllegoryOS AI outputs are designed to assist and accelerate human decision-making — not to replace it. No AI output generated within the AllegoryOS platform constitutes a binding decision — including underwriting decisions, rated quotes, or policy issuances — unless confirmed and authorized by a qualified human user. AI-generated content within the platform is presented as pre-populated inputs for human review. All parsed document outputs require explicit user review and confirmation before being applied to any rating calculation or downstream action.

7.4 No Training on Client Data

Allegory will not use client data — or personal information processed on behalf of any client — to train, fine-tune, or improve any AI model or platform capability without the prior written consent of the applicable client. This prohibition applies to all AI model providers used by AllegoryOS, including Anthropic.

7.5 Platform-Level AI Logs

While Anthropic does not retain AI processing data, Allegory's platform captures infrastructure-level logs of AI API calls for operational, security, and debugging purposes. These logs capture metadata — including timestamps, token counts, response latencies, and error codes — and may capture system prompt and output content where strictly necessary to debug a specific identified fault. Access to any logs containing client data is restricted to Allegory personnel holding authorized credentials with a legitimate operational, security, or audit purpose. An access log is maintained recording all instances of personnel access to Client Environment logs. Clients may request a summary of log access events at any time on reasonable written notice.

AI-related log retention periods:

8.1 Infrastructure

AllegoryOS is hosted entirely on Amazon Web Services (AWS) managed cloud infrastructure. Application data is stored within AWS managed services, including DynamoDB (database), S3 (file storage), and Cognito (authentication). Allegory has no physical on-premises infrastructure.

8.2 Client Environment Isolation

Each enterprise client is assigned a dedicated Client Environment within AllegoryOS. Client Environments are logically isolated by a unique enterprise identifier. No client data processed within one Client Environment is accessible to or processable by any other client environment.

8.3 Encryption

• At rest: AES-256 encryption is applied to all DynamoDB tables, S3 buckets, and Cognito authentication data stores using AWS Server-Side Encryption (SSE). AWS Key Management Service (KMS) customer-managed keys are used for sensitive stores including Terraform state and authentication credential encryption. S3 bucket policies deny unencrypted object uploads.
• In transit: TLS 1.2 minimum is enforced across all CloudFront distributions, API Gateway endpoints, and Cognito domains. S3 bucket policies deny non-HTTPS transport. All connections to the platform enforce encrypted communication at all times.

8.4 Access Controls

• All AWS infrastructure access uses named IAM user profiles or IAM roles. Shared credentials are prohibited.
• Multi-factor authentication (MFA) is mandatory for all AWS console access and is enforced for platform authentication via AWS Cognito, supporting both TOTP (authenticator app) and SMS OTP.
• IAM permissions follow least-privilege principles, scoped to specific AWS resource ARNs and required actions. No wildcard resource permissions are used on sensitive services.
• User access to Client Environments is provisioned and revoked by Allegory on request only; there is no self-service user management.
• IAM roles used by automated systems (Lambda, ECS, CI/CD pipeline) use short-lived credentials via OIDC or instance profiles. No long-lived access keys are issued to automated systems.
• All API-level access events are logged via AWS CloudTrail with multi-region coverage, log file validation, and encrypted S3 storage.

8.5 Security Monitoring

• AWS GuardDuty: Continuous threat detection analyzing CloudTrail logs, VPC Flow Logs, and DNS logs, with findings generated within 15 minutes
• AWS CloudTrail: Multi-region audit logging of all API-level activity with cryptographic log file validation
• AWS IAM Access Analyzer: Continuous detection of unintended resource exposure
• Amazon CloudWatch: Metric-based alerting on anomalous activity across Lambda, API Gateway, DynamoDB, and ECS Fargate services
• All compute resources operate within VPC private subnets, inaccessible from the public internet. There are no persistent server endpoints accessible via SSH or RDP — compute is fully serverless (Lambda and ECS Fargate)

8.6 Privacy by Design

Privacy protection is embedded into AllegoryOS architecture as a design principle:

• Pseudonymization by design: All records use UUIDs as primary identifiers (user, enterprise, and session identifiers). Personal identifiers are not used as database keys, separating authentication identity from application data.
• Data minimization: Only the information required to deliver contracted services is collected and processed.
• Purpose limitation: Client data is not used for any purpose beyond service delivery.
• Storage limitation: Defined retention periods and automatic TTL-based expiry are applied to all data categories.
• Environment separation: Fully separate development and production environments are maintained throughout delivery. No production client data is used in development or testing.

8.7 Upload Scanning

All files uploaded to AllegoryOS endpoints are scanned for known threats prior to processing.

8.8 Physical Security

Physical security of the underlying data centre infrastructure is governed by AWS under its shared responsibility model. AWS holds ISO 27001 and SOC 2 Type II certifications for its data centre physical security controls.

9.1 Canadian Data Residency

All client data stored within AllegoryOS is held in AWS ca-central-1 (Canada — Montreal, Quebec). Canadian data residency is a material contractual requirement for all client engagements. Any change to the data residency configuration of a Client Environment requires the prior written consent of the applicable client.

9.2 Content Delivery

AllegoryOS uses AWS CloudFront for the global delivery of static application assets. No personally identifiable information or commercially sensitive client data is stored or cached at CloudFront edge nodes. Edge infrastructure is used solely for static asset delivery to optimize performance.

9.3 AI Inference

Document content submitted for AI parsing is transmitted to Anthropic's API for real-time inference. Anthropic's infrastructure is US-based. As described in Section 7.2, Anthropic's Zero Data Retention policy means no client data is retained by Anthropic following the API response. This transmission is transient and does not constitute cross-border storage of client data.

9.4 Transactional Communications

Email (AWS SES) and SMS (AWS SNS) transactional communications are routed through AWS infrastructure. No submission data, client data, or personally sensitive information is included in or transmitted through communications infrastructure beyond what is required to address the named recipient.

9.5 Notification of Required Transfers

In the event that any applicable law or regulation requires Allegory to store, process, or disclose client data outside of Canada, Allegory will notify the applicable client promptly, and the parties will cooperate to address the requirement in a manner consistent with the client's regulatory obligations.

Allegory generates revenue from contracted platform services, not from data monetization. Personal information processed through AllegoryOS is never shared with data brokers, advertisers, insurance carriers acting outside a contracted engagement, or any third party for commercial gain.

We may aggregate and anonymize operational data for internal analytics, platform improvement, or industry research. Data aggregated and anonymized in this manner cannot be traced back to identifiable individuals or client organizations.

Allegory uses the following third-party services to operate AllegoryOS. We do not onboard additional sub-processors that access client data without assessing their security posture and contractual data handling commitments.

11.1 Amazon Web Services (AWS)

Purpose

Cloud infrastructure, compute (Lambda, ECS Fargate), database (DynamoDB), file storage (S3), authentication (Cognito), content delivery (CloudFront), email (SES), SMS (SNS), security monitoring (GuardDuty, CloudTrail, IAM Access Analyzer)

Data processed

All client data and platform operational data is stored on AWS infrastructure

Data residency

Primary — ca-central-1 (Canada); transactional communications — us-east-1

Compliance

AWS Customer Agreement, AWS Data Processing Addendum, ISO 27001, SOC 2 Type II

Privacy policy

aws.amazon.com/privacy

11.2 Anthropic

Purpose

Foundational AI model inference for document parsing and AI-assisted underwriting workflows

Data processed

Document content and inputs submitted for AI parsing — transient only, subject to Zero Data Retention policy

Retention

Zero — Anthropic does not retain prompt inputs or outputs after API response completion

Compliance

Anthropic API Terms of Service, Zero Data Retention policy

Privacy policy

anthropic.com/privacy

11.3 GitHub

Purpose

Version control and CI/CD pipeline — internal to Allegory's delivery and operations process

Data processed

Source code and infrastructure configuration only. No client data passes through GitHub.

Privacy policy

github.com/site/privacy

11.4 In-House Analytics

Allegory does not use third-party analytics platforms such as Google Analytics, Segment, Mixpanel, or similar services. All usage analytics are processed in-house through AllegoryOS's own operational data pipeline. No usage data is shared with third-party analytics providers.

AllegoryOS uses cookies and similar technologies for the following purposes:

Essential cookies

Maintain authenticated sessions, preserve login state, and ensure core platform functionality. These are required for the platform to operate and cannot be disabled without affecting functionality.

Operational cookies

Track platform usage patterns to monitor performance and improve services. Processed entirely in-house; not shared with any third parties.

Allegory does not use marketing cookies, advertising trackers, or third-party analytics cookies of any kind. You can manage cookie preferences through our Cookie Consent banner or your browser settings. Disabling essential cookies will affect your ability to access authenticated areas of the platform.

13.1 Individuals Whose Data Allegory Controls

If you are a Client User or website visitor whose personal information Allegory controls, you have the following rights under PIPEDA and, where applicable, Quebec Law 25:

Right of Access

You may request confirmation of whether we hold personal information about you and, if so, access to that information and details about how it is being used.

Right to Correction

You may request correction of inaccurate or incomplete personal information we hold about you.

Right to Withdrawal of Consent

Where processing is based on consent, you may withdraw consent at any time, subject to legal or contractual restrictions. Withdrawal does not affect the lawfulness of processing before the date of withdrawal.

Right to Deletion

Subject to legal and contractual retention obligations, you may request deletion of personal information we control about you.

Right to Lodge a Complaint

You have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca, or — for Quebec residents — the Commission d'accès à l'information (CAI) at cai.quebec.ca, if you believe we have handled your personal information in a manner inconsistent with applicable law.

To exercise any of these rights, contact us at privacy@allegoryos.com. We will respond within 30 days of receipt.

13.2 Individuals Whose Data Allegory Processes on Behalf of Clients

If your personal information is contained within data submitted by one of our enterprise clients — for example, your contact details appear in an insurance submission document processed through the platform — Allegory is the data processor and your rights in respect of that data should be directed to the organization that holds the controller relationship with you.

Allegory will cooperate with clients to support the fulfilment of individual rights requests within the technical capabilities of the platform. DynamoDB tables within Client Environments are queryable by user and record identifiers, supporting access, correction, and deletion requests.

13.3 California Residents (CCPA)

Allegory's primary market is Canada. To the extent California residents access our website or services:

• We do not sell personal information, so there is nothing to opt out of
• California residents may request access to or deletion of personal information we control by contacting privacy@allegoryos.com
• We will not discriminate against you for exercising your California privacy rights

13.4 European Union and United Kingdom (GDPR / UK GDPR)

Allegory does not offer services to residents of the European Union or United Kingdom, and AllegoryOS is designed for Canadian insurance operations. We do not have a legal establishment in the EU or UK, and we do not systematically target EU or UK residents. If you are located in the EU or UK and access our website, your data is processed in Canada under this Privacy Policy and Canadian law. We recommend that organizations subject to GDPR requirements confirm applicable regulatory obligations before engaging with AllegoryOS.

14.1 Client Data (Processor Capacity)

Client data is retained within the Client Environment for the duration of the applicable client agreement. Upon expiry or termination of a client agreement:

• Allegory provides the client with a 30-day data extraction period during which all client data may be extracted from the Client Environment in a structured, machine-readable format
• Following the extraction period, Allegory securely decommissions the Client Environment and provides the client with written confirmation that all client data has been permanently deleted from the platform
• Where retention of specific data is required by applicable law, regulation, or Allegory's own audit and legal obligations, Allegory will identify the specific data retained, the legal basis for retention, and the period for which it will be held

14.2 Platform Logs

14.3 Transient Data

Certain operational data within the platform expires automatically via DynamoDB Time-to-Live (TTL):

14.4 Controller-Capacity Data

Personal information that Allegory controls is retained only for as long as necessary for the stated purpose, after which it is deleted or anonymized:

AllegoryOS uses passwordless authentication that may include SMS-based one-time passcode (OTP) delivery to platform users.

15.1 How SMS Verification Works

SMS messages are sent only when a user initiates an authentication request on the platform. Each message delivers a single-use verification code in direct response to that user-initiated action. We do not send marketing, promotional, or informational messages via SMS. SMS delivery is handled by AWS Simple Notification Service (SNS).

15.2 Consent

Where SMS OTP is used as an authentication method, consent to receive a one-time verification code is confirmed at the point of the authentication action before any message is sent. Platform users may also authenticate using TOTP via an authenticator application as an alternative that does not require SMS delivery.

Message and data rates from your wireless carrier may apply. One message per authentication attempt. For help, reply HELP or contact hello@allegoryos.com.

15.3 Opt-Out

You may opt out of SMS messages at any time by replying STOP to any SMS received from us. You will receive one final confirmation message acknowledging your opt-out. No further SMS messages will be sent to your number unless you re-enroll.

15.4 SMS Data

SMS opt-in data and consent records are used solely for platform authentication purposes. SMS opt-in information is not shared with any third parties and is expressly excluded from all data sharing practices described elsewhere in this Privacy Policy.

15.5 Carrier Compliance

Allegory complies with all applicable US and Canadian telecommunications regulations, including the Telephone Consumer Protection Act (TCPA) and Canada's Anti-Spam Legislation (CASL). Carriers are not liable for delayed or undelivered messages.

Allegory maintains a formal Incident Response Plan with documented procedures for detecting, containing, investigating, and remediating security incidents.

Client Notification

Where an incident involves actual or reasonably suspected unauthorized access to, disclosure of, loss of, or destruction of client data held within the platform, Allegory will notify the applicable client in writing within 48 hours of becoming aware of the incident. The notification will include: the nature of the incident; the categories and approximate volume of client data affected; the likely consequences of the incident; and the measures Allegory has taken or proposes to take to address the incident.

Regulatory Cooperation

Allegory will cooperate fully with clients in investigating and remediating any incident and will provide reasonable assistance to support the client's regulatory notification obligations under applicable law, including PIPEDA breach reporting and applicable provincial regulatory requirements.

Individual Notification

Where applicable law requires notification to individuals whose personal information Allegory controls, we will provide such notification in a timely manner consistent with that law.

Incident response records and communications are retained for a minimum of three years.

AllegoryOS is an enterprise platform for insurance professionals and organizations. It is not directed at, designed for, or intended to be used by individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that personal information of a minor has been submitted to the platform, we will take reasonable steps to delete it promptly.

18.1 Service Availability

AllegoryOS is designed and operated for insurance organizations in Canada. While our website is accessible globally, we do not currently offer enterprise platform services to organizations outside Canada.

18.2 PIPEDA Compliance

Allegory complies with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Individuals and clients have the right to access, correct, and — where applicable — request deletion of their personal information as described in Section 13 of this Privacy Policy.

18.3 Quebec Law 25

For processing activities involving Quebec residents or organizations, Allegory applies the requirements of Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25), including data minimization, transparency obligations, and privacy impact assessment requirements for high-risk processing activities involving personal information.

18.4 Transient AI Inference Transfer

As described in Sections 7.2 and 9.3, document content is transmitted to Anthropic's US-based API for real-time inference. Anthropic's Zero Data Retention policy means no client data is retained by Anthropic following the API response. This transmission is transient and does not constitute cross-border storage of client data. Allegory will notify affected clients promptly if this arrangement changes in a material way.

18.5 No EU/UK Data in Scope

Allegory does not systematically process data relating to EU or UK residents and does not have a legal establishment in the EU or UK. GDPR and UK GDPR are not primary applicable frameworks for our operations. See Section 13.4 for additional detail.

We may update this Privacy Policy from time to time to reflect changes in our platform, services, or applicable legal requirements. When we make material changes:

• We will update the Effective Date at the top of this page
• We will notify affected clients and Client Users via email
• Your continued use of AllegoryOS after changes take effect constitutes acceptance of the updated policy

We encourage you to review this Privacy Policy periodically. Prior versions are available on request.

For privacy inquiries, rights requests, or concerns regarding this Privacy Policy or the handling of personal information by Allegory, please contact us:

Email: privacy@allegoryos.com

We will respond to all privacy inquiries within 30 days of receipt.

To report a security concern or suspected incident: security@allegoryos.com

Office of the Privacy Commissioner of Canada

priv.gc.ca

Commission d'accès à l'information (Quebec)

cai.quebec.ca