Trust and security

This page exists so you can hand it to whoever asks: your privacy officer, your E&O carrier, or the person at your brokerage who has to sign off on a new vendor. If something here is not enough detail, ask and we will send the full due-diligence pack under NDA.

Security questions go to hello@ardellsystems.com. We answer within two business days.

What we are

Ardell Systems is an Alberta company that builds and operates AI-assisted administrative systems for insurance brokerages. We are not an insurance agent, broker, or adjuster, and we do not provide insurance advice. The systems we build perform administrative preparation only. Every client-facing or policy-affecting action is approved by your licensed staff.

Where your data lives and what runs where

Each system is deployed into your own Microsoft cloud subscription. The resources that hold your data, being the database, document storage, search index, and key vault, are yours, are located in Microsoft's Canadian Azure regions, and remain yours if our engagement ends.

Model processing is a separate decision and we make it explicitly with you:

Whichever applies to your system is recorded in your agreement. We do not describe one as the other.

Note on provider review. Microsoft operates abuse monitoring on its AI services, under which flagged content may be retained and reviewed by Microsoft. Where a brokerage requires that this not apply, we will discuss applying for Microsoft's modified abuse monitoring exemption before deployment.

Audit and oversight

Logging

Every agent action is traced and written to storage in your subscription: what came in, what the system did, what it produced, and who approved it. Retention is set by you.

Approval gates

Client-facing output goes to a review queue. A licensed member of your staff approves, edits, or rejects it. The system has no path around that queue.

Content controls

Provider-level content filtering and prompt-injection protection are enabled on every deployment.

Model changes

AI models are retired by their providers on published schedules. We track those dates for the models your system uses and migrate before they take effect. This is part of the monthly fee, not a project.

Privacy posture

Alberta PIPA and PIPEDA

Your brokerage remains the organization accountable for personal information. We act as a service provider on your instructions and for your stated purposes only.

Written agreement

We will sign a data processing agreement covering permitted use, safeguards, sub-processors, cross-border processing, breach notification to you, retention, and deletion on termination. We offer this rather than waiting to be asked. Alberta's PIPA review committee recommended mandatory vendor contracts in February 2025; no amendment bill has been introduced as of mid-2026, so today this is a choice rather than a requirement.

Your privacy contact

PIPA requires your organization to designate someone responsible for privacy compliance. We work to that person and give them what they need to answer for the system.

No training on your data

Your data is never used to train any model.

What "compliance-grade" means here

We use that phrase on our homepage, so here is exactly what is behind it, with nothing implied:

• Identity and role-based access control through Microsoft Entra ID
• Client data stored at rest in Canadian Azure regions, in infrastructure the client owns
• Full action-level logging to client-owned storage
• Human approval gates on all client-facing output
• Provider content filtering and prompt-injection protection enabled
• A signed data processing agreement

What it does not mean. We do not hold SOC 2 or ISO 27001. We are a one-person firm and a formal audit is not something we can produce today. The controls listed above are what we do instead.

Sub-processors

The systems we build for you run on Microsoft Azure in Canada. Our own website and business tools involve providers outside Canada, and we list them so there is no confusion between the two: Cloudflare for website hosting, Cal.com for booking, and Microsoft 365 for our own email. Information you send us through this website is handled under our privacy policy. The residency statements on this page apply to the systems we build, not to our marketing website.

Forward this page

If you are evaluating us, send this to your privacy officer or your E&O contact and copy hello@ardellsystems.com. Their questions are easier to answer now than at signing.