Security
AI that acts,
under your control.
Panora works in your tools and on your insurers’ portals. Your data stays in Europe, walled off per brokerage, and no sensitive action goes out without your approval.
GovernanceSecurity led by the CTO and an outsourced CISO. Quarterly review, yearly training for the whole team, policies monitored continuously.
Your data, hosted in Europe and walled off.
Hosted in France
AWS, Paris region, across several zones. No data leaves the European Union.
Encrypted in transit and at rest
TLS 1.2 minimum in transit, AES-256 at rest. No secret in plain text in the code.
Every brokerage walled off
Isolation per organisation down to file storage, verified on every release. Dedicated instance on request.
AI and agents
Agents always under your control.
The models run in the European Union and learn nothing from your files. The agent acts within a set scope and stops before every sensitive action.
Approval enforced, not optional
An email, a quote, an entry on an insurer portal: the agent pauses and waits for a user to approve.
Confined to its task
It acts on behalf of an identified broker, with their permissions, on allowed addresses only.
Models run in the European Union
On AWS Bedrock, in an EU region, with no third-party API. Several models, no dependency on a single provider.
No training, zero data retention
No model is trained on your data or your clients’ data. Zero Data Retention (ZDR) policy: the provider keeps neither prompts nor responses.
Traceability
Every action has a time, an author and a source.
Panora reads, prepares and stops before every sensitive action. You approve, it executes. Everything is logged: who did what, when, on what basis.
- 01
The broker
Identified and authenticated, they start the task with their own access and approve every sensitive action.
- 02
Panora agent
Always acts on behalf of an identified broker. Reads, prepares, proposes, confined to its task and to the allowed addresses.
- 03
Your tools
Management software, insurer portals, email: it writes there only after your approval. On a portal, every browsing action is recorded, video and timeline included.
Audit log
Nexalis SAS file · on behalf of Claire Morel
- 09:41Email received in the claims inboxPanoraOutlook
- 09:424 documents extracted, sources citedPanoraPDF · p. 3
- 09:44Covers checked on the AXA portal, browsing recordedPanoraVideo · 38 s
- 09:45Action proposed: send the RC Pro endorsementPanoraAwaiting approval
- 10:05Action approvedClaire MorelAccount handler
- 10:05Email sent, CRM updatedPanoraOutlook · Veos
Every action can be replayed, with its source. On the portals, the video and the timeline of every browsing session.
Monitored, tested, backed up.
Controlled access
Single sign-on and multi-factor authentication enforced, least privilege, quarterly access reviews.
Tested by third parties
Annual penetration test by a CREST-certified firm, continuous container scanning, mandatory code review.
Backed up, replicated
Continuous encrypted backups, database replicated across several zones, continuity plan tested every year.
Monitored
Centralised monitoring and automatic alerts. An incident affecting your data is notified to you within 72 hours.
Audited, certified, compliant.
A certification only shows as obtained once the certificate is issued.
ISO/IEC 27001:2022
CertifiedSince August 2026, issued by an accredited body. The information security management system is audited every year.
SOC 2 Type II
In progressSecurity, availability and confidentiality controls, audited over time.
ISO/IEC 42001
PlannedAI management system: governance, risks and transparency of use.
GDPR
CompliantData hosted and processed in the European Union. Data processing agreement (DPA) available.
Documents on request
- Security policy
- Business continuity and disaster recovery plans
- Penetration test report
- ISO/IEC 27001 certificate
- Data processing agreement (DPA)
Your security questions
Another question? Write to security@panora.co
Yes. Panora has been ISO/IEC 27001:2022 certified since August 2026, by an accredited body. The certificate is available on request.
SOC 2 Type II is in progress. We will show it as obtained once the report is issued, not before. ISO/IEC 42001, the AI management standard, is planned next.
In France, on AWS in the Paris region, across several zones. No data leaves the European Union, AI included: the models run in an EU region.
No. No model is trained on your data or your clients’ data. The models are used under Zero Data Retention (ZDR): the provider keeps neither prompts nor responses.
Every record carries its brokerage’s key, down to file storage, and any access outside that scope is rejected. Automated tests check this isolation on every release. A dedicated instance is available on request.
Read and prepare. Any sensitive action (an email, a quote, an entry in your software or on an insurer portal) pauses the agent until a user approves it. Every action is logged with its time, its author and its source.
Each broker’s credentials are kept in an encrypted vault, never shared. The two-factor code is requested from you, passed on once, never stored. More on the Connectors page.
A documented response plan applies, followed by a systematic review. If the incident affects your data, you are notified within 72 hours at the latest. Encrypted backups and a continuity plan, tested every year, keep the service running.
On request: security policy, business continuity and disaster recovery plans, penetration test report, ISO/IEC 27001 certificate and data processing agreement (DPA). Write to security@panora.co.