Your data, with the rules written down
Running an insurance agency's workload means touching its clients' data: names, ID numbers, sums insured, payment status. This page states which data we process, in which role, where it lives and who else is involved. What we don't have, we don't display.
We're a data processor, not the owner of your data
When cautia runs a workflow for your agency, your agency is the data controller and cautia is the processor: we process personal data following your instructions and the terms of our contract, under Law 1581 of 2012 and Decree 1377 of 2013.
That means three concrete things. We don't use your policyholders' data for our own purposes. We don't share it with other cautia clients. And if the contract ends, it is returned or deleted as agreed in writing.
There is one case where cautia is the controller: the data you give us through this site's contact form or by email. We process that to handle your request, and it's covered by our data processing policy.
Which data we touch and which we don't
- From insurance documents
- Policyholder or insured name and ID, risk location, insured asset details, coverages, deductibles, sums insured, premiums, policy terms, policy and endorsement numbers.
- From receivables and group policies
- Outstanding balances, payment status, ageing, additions, removals and increases in sum insured for group policy members.
- From your team
- Name, role and work email of the people who use the workflows or receive the outputs.
- From the site
- Contact form data and aggregate usage metrics, with no tracking cookies.
Do not submit banking credentials or unnecessary personal information. Do not upload medical records, biometrics or information about minors in this pilot. Agencies must be authorized to process submitted documents.
Where the data lives and who else is involved
cautia's infrastructure sits outside Colombia. We say it here and we declare it in the data processing policy, with the international transfer and transmission information the law requires.
- Cloudflare
- Hosting for this site, delivery network and aggregate analytics with no cookies.
- Outside Colombia
- Supabase
- Application identity, database and storage.
- Outside Colombia
- DeepSeek
- Artificial intelligence models to classify documents and extract structured information.
- Outside Colombia
- Mistral
- Text recognition (OCR) on scanned PDFs and images.
- Outside Colombia
- Resend
- Delivery of the contact form notifications.
- Outside Colombia
- Composio, Google, Microsoft, Kapso and Meta
- Optional email or WhatsApp channels, depending on the enabled integration.
- Outside Colombia
Documents and conversations may be processed outside Colombia. Not every provider participates in every task, and uniform retention or training policies are not promised. Ask hola@cautia.ai about a workflow before supplying restricted information.
Retention, human review and what we don't have
- Retention
- Information is kept for service, security and legal needs. Request return or erasure at hola@cautia.ai. Backups and evidence may remain restricted; immediate deletion is not promised.
- AI, declared
- All our workflows use artificial intelligence and we say so openly. No decision about a person is taken automatically: there is human review before any document goes out. This is what Colombia's SIC External Circular 002 of 2024 on personal data in AI systems requires.
- Access and credentials
- Each agency has its own credentials for email and systems; they are never shared between clients.
- What we don't have
- cautia holds no SOC 2, ISO 27001 or any other security certification, which is why we don't display one. We also don't promise “guaranteed security”: what we offer is telling you exactly what we do and with which providers.
Where the person comes in
Every workflow ends at the same point: a person opens the output the AI analysts produced, checks it against the source document and decides whether it goes out. Nothing reaches an insurer or a client without going through that step.
Your rights and who you exercise them with
If you are a policyholder of an agency that works with cautia, the rights to access, update, correct and delete your data and to withdraw your authorisation are exercised with the agency: it is the data controller. We support it with whatever it needs to answer you within the terms set by law.
If you wrote to us through this site, we process that data ourselves and you can exercise your rights directly with cautia. The channels, the terms and the procedure are in the data processing policy.
Read the data processing policyQuestions about how we handle your data?
The data processing policy has the full detail: purposes, sub-processors, international transfer and the channels to reach us. If anything is unclear, write to us before signing anything.