Security and data handling

Where data lives

Carrier Bridge's primary hosting and storage are in Renaissance's own Microsoft Azure subscription, in Azure's East US 2 region in the United States. Anthropic also processes client content, under a Business Associate Agreement, as AI processing below describes.

The parts that hold client data are Azure Container Apps (the application and its processing workers), Azure Cosmos DB (run records and account data), Azure Blob Storage (files) and Azure Files (each client's working memory files).

Encryption

• Connections to Carrier Bridge use HTTPS. Our database and storage accounts accept TLS 1.2 or higher only.
• Every active production database and storage account that holds client files or run records is encrypted at rest with a customer-managed key: a key Renaissance controls in its own Azure Key Vault, which has purge protection turned on.
• Logs and monitoring data, which are designed to hold no file contents, are encrypted with keys Microsoft manages.
• Until October 14, 2026, we also keep a rollback copy of our database as it stood on October 7, 2026, when we moved to the customer-managed key. That copy is encrypted with a key Microsoft manages, receives no new data, and will be deleted on October 14, 2026.

Sign-in and access

• Users sign in with a Microsoft work account, or with a sign-in link emailed to them that works once and expires after 15 minutes.
• Each client names a client admin, who can invite users, disable and restore them, and see the submissions of the client's users.
• A signed-in session is held in a secure, HTTP-only cookie limited to the Carrier Bridge address that set it. It lasts until 30 days after the user's last visit.
• Platform administrator access, and access to our Azure environment, is limited to Renaissance's three founders and to the service's own system identities. The founders' accounts require multi-factor authentication. The only accounts exempt are two emergency-access accounts, and any sign-in to them raises a top-severity alert.
• Our staff look at client data only to run, support, secure or bill the service, or when the client asks.

Keeping clients apart

• Every record that belongs to a client carries that client's identifier, and the application limits each user to their own client's data.
• New clients' files are kept in a storage account dedicated to that client, encrypted with the customer-managed key and closed to shared-key access.

Two things are shared on purpose:

• Part of what Carrier Bridge learns about file layouts (column names and their meanings, code lists, mapping rules and templates) is pooled across clients, so each client benefits from what the service has learned. It is designed to hold layouts only, not member records, and any member information found in it is treated as a security incident.
• Our founders, as platform administrators, and the service's own system identity can reach every client's data in order to run, support and secure the service.

Logging and monitoring

• Carrier Bridge is designed so that file contents are not written to application logs, diagnostics or monitoring data. Error messages are reduced to safe text before they are logged.
• As a backstop, a redaction filter masks Social Security numbers, other nine-digit numbers, email addresses, US phone numbers and dates of birth in log lines before they are written. The filter cannot reliably detect personal names, which is why we keep file contents out of logs by design rather than relying on it.
• Application logs and performance telemetry, which is sampled, are kept for 90 days. Azure platform logs, including the storage access logs that record each file's name when it is read or written, are copied to a separate write-protected archive and kept for 365 days.
• Our security audit log records who did what in Carrier Bridge, using identifiers rather than file contents, along with the user's IP address and browser type. It is kept for at least six years and does not expire automatically.
• Azure Monitor alerts on security and operational events and notifies our founders by email and in Microsoft Teams. Failed runs raise an alert automatically.

AI processing

• Carrier Bridge uses Anthropic's Claude models through Anthropic's API, under a Business Associate Agreement Renaissance signed with Anthropic on July 2, 2026.
• Each request asks Anthropic to process it in the United States, and every model the service currently uses accepts that setting.
• We do not use client data to train or fine-tune AI models. Anthropic's commercial terms do not permit it to train models on the content we send.
• The code that reads and writes client files runs inside our own Azure environment, in a separate locked-down workspace for each run. Client data is never sent to a model vendor's hosted agent or code sandbox.
• Temporal Technologies (Temporal Cloud) schedules Carrier Bridge's processing steps. Since October 9, 2026, it receives identifiers and status only: file names, instructions and file contents stay in Renaissance's Azure database and storage, and every message is also encrypted with a key that only Renaissance holds.

Retention and deletion

When a client's agreement ends, we purge its account within 30 days. The purge deletes the client's users, run history, saved templates, its own layout knowledge and its other remaining records. Records deleted by the purge can be restored from the database backup for 7 days, and are gone after that. Carrier Bridge has no bulk export, so users download the output files they need while the files are kept.

Backups

The database has continuous backup with point-in-time restore over the previous 7 days. We tested a full restore on October 7, 2026. Deleted files can be restored for 1 day, and deleted storage containers for 7 days.

Incident notice

We follow a written incident response procedure led by our HIPAA Security Official.

Under our standard Business Associate Agreement, if we discover a breach of unsecured protected health information, or a use or disclosure of it that the agreement does not allow, we give the client first notice without unreasonable delay and no later than 10 business days after discovery. A written report follows no later than 30 calendar days after discovery. We report other security incidents affecting protected health information within 30 calendar days. Notices go by email to the client's notice contact, followed by a phone call or a written notice by courier.

People and assurance

• Everyone at Renaissance with access to client data is bound by confidentiality duties and completes HIPAA training before handling protected health information.
• Renaissance carries technology errors and omissions insurance and cyber liability insurance.
• Once a year, on request, we answer a client's reasonable written security questionnaire and provide our compliance pack: our subprocessor register, our certificates of insurance, and the compliance reports and certifications Anthropic and Microsoft publish or allow us to share. Renaissance itself does not hold a SOC 2 report or an ISO certification.
• The outside services we use are listed on our Subprocessors page.

Report a vulnerability

If you believe you have found a security problem in this website or in Carrier Bridge, email support@renaissance.systems with "Security" in the subject line. It reaches all three of our founders. Please tell us what you found and how to reproduce it.

Do not access, change or keep data that is not yours, and do not run tests that could disrupt the service or affect our clients. Please give us a reasonable chance to fix the problem before you tell anyone else.