Built by people who've spent a decade protecting customer data in regulated markets
HumanApproved is built and run by Open, which has spent more than 10 years helping insurers and financial services brands sell regulated products in the UK and Australia.
Enterprise-grade protection
Access controls and monitoring
An in-house security team, continuous monitoring, single sign-on with SAML, audit logs on every console action, and IP allow-listing for your staff.
Data stays in your region
Approvals are processed and stored in your region: the United Kingdom, the United States, or Australia, each a separate deployment with its own data store. You set how long Open keeps records, and you can ask Open to delete them at any time.
No model training
Open's Platform Agreement commits Open not to use your data, or your customers' data, to train any model.
Every approval is signed
Each approval is signed with a key Open holds and tied to the exact quote and page version the customer saw, so a record can be verified at bind and years later, without trusting a copy.
Contractual commitments
A security addendum with binding terms, incident notification within set hours, and a data processing agreement for your region.
Independent testing
Annual penetration tests by an independent firm, continuous vulnerability scanning on every deployment, and an independent SOC 2 audit each year.
Your quotes and underwriting data stay yours
The approval page has to show your customer, the person approving the purchase (the Approver), the quote and their answers, so the plain text has to exist somewhere. HumanApproved opens it only on the Approver's device, and for you. Quote and underwriting data are end-to-end encrypted before they reach Open, and Open stores and signs approval records without holding the keys to their contents.
Sealed at your checkout
Before anything reaches Open, the quote and the underwriting answers are encrypted with a key made for that one approval. That key is locked twice: once for the Approver, inside the review link, and once with your own public key, so you can always reopen the record.
Delivered by link and code
The Approver's key sits after the # in the review link, a part of the address browsers never send to any server. A one-time code goes to the Approver separately, by SMS, as an access check. An AI agent can pass the link on, but never receives the code.
Opened only on the Approver's device
The Approver's browser unlocks the envelope and shows the quote alongside your current policy documents. They enter the code and approve or reject. Nothing can be edited: if something is wrong, they reject, the agent fixes the quote, and a new approval starts.
Signed without being read
Open signs an approval record holding the sealed envelope, a fingerprint of its contents, the document versions, the Approver's action, and the time. You open it with your private key; Open can prove it hasn't changed, but can't open it.
Choose how far to take it, product by product
- StandardOne script on your checkout
The gate script seals the data in the checkout browser, and Open sends the review link and code. Open handles the Approver's key once, only to send that message, then discards it; it's never stored or logged. Quote and underwriting data stay end-to-end encrypted, and approval records are stored in a form Open can't open.
- AdvancedAdd Open's server SDK
Your own server seals and signs the data, and sends the link and code through your own SMS provider. Open never has access to your quote or underwriting data, or to the Approver's contact details, and your security team can verify it.
Either way, Open keeps only what it needs to run, secure, and bill for the service: no premium, no underwriting answers, and no sensitive data. Purchases made through an MCP server (a connection an AI agent calls directly, with no browser) use the server SDK.
Standards and regulations Open meets
These are the standards and regulations Open works to.
What security reviews ask
What counts as Customer Data?
Everything you give Open, and everything the Approver enters or confirms on an approval page: your product content, the quote, the underwriting answers, the contact details used for the one-time code, and the approval records. You own it and you're the controller; Open processes it on your behalf.
What is Service Data?
The operational data Open generates to run, secure, support, and bill for the service: agent-detection signals and scores, device and session telemetry, approval references and status, product identifiers, the count of approvals, logs, and aggregated statistics. It doesn't include the quote or the underwriting answers, and it's what Open bills from, so Open never needs to see the premium or whether a policy was bound.
Where is it hosted?
In your region: separate UK, US, and Australian deployments, each with its own data store, keys, and backups. Customer Data isn't replicated between regions, and Open gives you 90 days' notice of any change of hosting region.
Can Open read our quotes or underwriting answers?
Open doesn't need to, and the service is designed so it doesn't. With the Advanced installation, Open never has access to them, and you can verify this. With the Standard installation, they're end-to-end encrypted and stored in a form Open can't open; Open handles the Approver's key only to send the review link, discards it straight away, and logs and reports any break-glass access. See the sealed envelope above.
Who at Open can see it?
Access is role-based and limited to what's needed. Support sees approval references, status and timestamps, not what was approved, and every lookup from outside your region is logged and can be reported to you. Support helps with links, codes and access; it doesn't explain cover or give insurance advice, and refers questions about the policy to you.
Does Open use our data to train AI models?
No. Customer Data, including your customers' data, is never used to train, fine-tune, or evaluate any model, Open's or anyone else's, and the same restriction applies to Open's sub-processors. Open uses only aggregated, de-identified Service Data to run and improve the service.
How long does Open keep it, and can we delete it?
You set the retention period for approval records in your order form; Open recommends at least the limitation period for the product, usually seven years after the policy ends in Australia and six in the UK. On your written instruction, Open deletes Customer Data within 30 days, subject only to legal hold, and confirms when it's done.
How is it protected?
End-to-end encrypted from your checkout to the Approver's device, as set out above, as well as in transit and at rest. Every approval record is signed with a key held in a hardware security module and can be verified with Open's published public keys, without access to Open's systems.
Can an AI agent approve on the Approver's behalf?
Approval pages are built to detect and stop automated browsers and scripted input, and the one-time code goes to the Approver. Detection is probabilistic, so you choose when approval is required and can add your own signal alongside Open's.
What happens if there's a security incident?
Open notifies you of a confirmed incident affecting your Customer Data within the hours set in your Security Addendum, followed by a written report. The incident process covers every region Open operates in.
How often are you audited?
An annual penetration test by an independent CREST-accredited (or equivalent) firm, automated vulnerability scanning on every production deployment, and independent audits against the standards above. Reports and penetration test attestations are available under NDA.
Is HumanApproved regulated as an insurer or broker?
No. HumanApproved is provided by the Open technology company in your market, which is a technology service provider, not an insurer, intermediary, or adviser. You remain the distributor and are responsible for the sale and the content shown to the Approver.