Security, Privacy & Professional Accountability

What MPAI is, and what it is not

MPAI is an AI-assisted policy review tool for licensed public adjusters. It organizes potentially relevant policy provisions, with references to the original language, so you can review them faster. It does not determine coverage, give legal advice, or replace your professional judgment. You review the source policy and make the determinations.

The data MPAI handles

Policy documents you upload as a PDF, Word file, or phone camera photo. The findings MPAI generates from them. The professional evaluations you type and save next to each issue. Your account and license attestation records. Payment details are handled by Stripe, not stored by MPAI.

Where data goes

When you upload a policy, it is processed to produce the findings you see. The pieces involved are listed below.

• App hosting: the MPAI app runs on Netlify.
• Database and backend functions: Supabase.
• AI analysis: the Anthropic Claude API.
• Payments: Stripe.
• Marketing site: the public website you are reading is hosted separately and does not receive policy documents.

Our Privacy Policy is the controlling document for what we collect and why. If anything on this page differs from it, the Privacy Policy and Terms of Service apply.

Private by Design. Processed for a Defined Purpose.

MPAI does not sell uploaded homeowner policy documents. Policy information is processed to provide the services requested by authorized users. This may involve authorized service providers supporting infrastructure, storage, security, and AI analysis, subject to applicable safeguards and contractual terms.

There is a difference between unauthorized disclosure and authorized processing. Unauthorized disclosure means access to, sale of, or distribution of policy documents outside authorized purposes — that is not what MPAI does. Authorized processing means limited processing by service providers necessary to operate the MPAI service, subject to appropriate agreements and controls.

Because authorized processing involves providers, policy content can reach the services listed above under their own terms. Masking or redacting identifiers reduces exposure, but it does not make an insurance policy anonymous — a property address is still personal information. Upload only what your review requires.

Access controls

MPAI uses Supabase for its database and backend services. Access controls, including Row-Level Security, help restrict access to records according to authorized user permissions. Row Level Security is enabled on our database tables, which limits each account to its own records at the database level. Compliance records, such as license attestations and terms acceptances, are insert-only for users and readable only by administrators. No update or delete permissions exist on those tables.

How we use AI, and how we check it

Every analysis is AI-generated and disclosed as such. AI output can be incomplete or wrong, so each finding includes a source reference you can check against the original policy. MPAI also runs a second-pass challenge review — the Observer™ framework — that questions the initial AI findings for potential omissions, contradictions, and unsupported interpretations before you rely on them. A second AI pass is not guaranteed to be more accurate and can repeat the same mistakes as the first; it is a challenge step, not a validation guarantee. Your own evaluations are entered by you, in your words, and are kept distinct from AI-organized findings.

Your Data. Your Controls.

MPAI provides defined controls for managing account and policy-review data. In-app deletion and retention controls were implemented on November 3, 2026, and a verified request process remains available through the contact form for anything the in-app controls do not cover. When a deletion is confirmed, the applicable records and stored files for the identified account or review are handled according to the platform's retention rules, while preserving only information that must be retained for legitimate legal, security, financial, or operational purposes.

What this covers: your active account data, uploaded policy documents, AI-generated analysis results, and your saved professional evaluations. What may be retained: transaction and billing records required for financial purposes, license attestation timestamps and terms-version records kept as compliance records, and security or diagnostic logs needed to protect the service. Backup and recovery copies, and data held by authorized processors, follow their own retention cycles and are not erased on the same schedule.

We do not promise a fixed numeric retention period, immediate permanent deletion across every system, or recovery of deleted content. If a deletion cannot be completed in full, we tell you what was handled and what remains and why.

Saved reviews, retention, and deletion

Saved workspaces, analysis results, and your professional evaluations are part of your review work. Temporary processing files are different from saved reviews. We do not promise a fixed retention period, automatic cleanup, or a guaranteed long-term archive, so keep your own file records. You can delete saved review content through the in-app deletion controls, or request redaction or deletion through the contact form — identify your account and the review concerned, and do not send the policy or unnecessary client information. Verified requests are handled by redacting personal information, and license attestation timestamps are kept as a legal record. Immediate or complete deletion across every system, and recovery of deleted content, are not promised.

Professional records

Review results, your professional evaluations, source references, and their timestamps are retained as part of the policy workspace they belong to, so your saved work stays associated with the policy issue it concerns. These records support your own file documentation; they are not a replacement for your firm's record-keeping obligations, and MPAI is not a guaranteed long-term archive.

Operational safeguards

Access to production data is governed by the database access controls described above, and compliance records are append-only for users. Changes to the marketing site and application go through a review and release process before publication. Security concerns can be reported through the channel below and are reviewed; we contact affected users as required by applicable law. We do not claim a formal monitoring certification or a guaranteed incident-free service.

Your responsibilities

Policy documents often contain personal information about your clients. Under our Terms of Service, you are responsible for redacting personal information that is not needed before you upload a document. Please upload only what the review requires, and verify every finding against the original policy.

Voice and dictation

MPAI does not record or transcribe audio. If you use your device's keyboard dictation, speech processing is handled by your device or keyboard provider under its own settings. MPAI receives only the text you enter.

Licensing and compliance approach

MPAI is intended for licensed public adjusters. A license attestation is required before prepaid checkout. This is an attestation, not independent license verification. MPAI supports professional workflows but does not replace licensing obligations, legal compliance, coverage interpretation, or independent professional judgment. We design with state licensing rules, consumer privacy law, and financial data safeguards in mind, but we do not claim certification or a formal compliance designation under any of them.

Reporting a security concern

If you believe you have found a vulnerability or a problem with how your data is handled, email eric.johnson@mobilepolicyadvisor.com with the subject line “Security”. Please include what you saw and how to reproduce it, and avoid including policy documents or client information. We review reports and will contact affected users as required by applicable law.

Changes to this page

We update this page when our practices change. The date at the top shows the latest revision.

Contact

Questions about this page can go through the contact form on the home page or to eric.johnson@mobilepolicyadvisor.com.