How we handle client data.

Carrier Bridge runs in Renaissance's own Microsoft Azure environment, in the East US 2 region of the United States. Each new client's files are kept in a storage account of its own, and every record carries the client's identifier, so each user sees only their own agency's data.

What Carrier Bridge learns about file layouts, such as column names and code lists, is shared across clients. It is designed to hold layouts only, never member records.

Connections use HTTPS. Since October 7, 2026, the database and file storage behind Carrier Bridge have been encrypted at rest with a key Renaissance holds in its own Azure Key Vault.

Users sign in at carrierbridge.app with a Microsoft work account or a sign-in link emailed to them that works once.

Uploaded files and finished files are deleted 7 days after they are uploaded or created. A run's working content, including the exchange with the AI model and any typed instructions, is blanked once the submission has been idle for 7 days.

Each file a run delivers is fingerprinted when it is stored and checked against that fingerprint at every download.

Client files are stored and processed by two services, each under a business associate agreement (BAA): Microsoft Azure, which hosts Carrier Bridge, and Anthropic, whose Claude models read the files. Each request to Anthropic asks for processing in the United States. We do not use client data to train AI models, and Anthropic's terms do not permit it to.

Since October 9, 2026, Temporal Cloud, which schedules the processing steps, receives identifiers and status only. Every outside service is listed on our Subprocessors page.

A security audit log records who did what in Carrier Bridge and is kept for at least six years. Azure Monitor alerts our founders by email and in Microsoft Teams, and a failed run raises an alert.