Security & deployment

Client-confidential deal data, in your cloud, under your controls

A data room holds a client’s most sensitive documents before a deal is public. InsightDealDesk runs in the brokerage’s own environment, keeps the model in its own cloud account and records every action an agent takes and on whose behalf.

Security

Built so compliance and model risk can say yes

Identity and roles

Sign-in through the Insight identity platform (OIDC), roles for deal broker, placement lead, practice leader, compliance and analyst, API keys, and an audit row for every change.

Book scope

Brokers see their own deals; leads see the practice. The copilot opens a deal only if it is in the asker’s book, and each tool re-checks.

PII masked

Personal data is masked before anything reaches a prompt. Per-agent daily budgets and a circuit breaker on every model call.

Grounded output

Engines own every figure; an answer with a number not in its cited facts is discarded. A finding with no citation is not shown.

Capped autonomy

Sending, approaching markets, selecting a quote, accepting a binder and signing off are capped at ask-first. Outside production every send is a dry run.

Signed exchanges

The InsightDueDiligence hand-off is HMAC-signed with a five-minute tolerance and idempotent; without a secret, nothing is accepted.

Traces and prompts

A Lense trace per agent step with model, tokens and cost; prompts versioned in InsightPrompts with local defaults.

Documents

Uploads go to the brokerage’s object storage — never to the server’s disk. Without a store configured, uploads are refused.

Decision record

Every control hit and every answer, signed — who decided what, on which facts, with what note.

Deployment

Your cloud, your database, your model account

flowchart LR
  U["Brokers"] -- HTTPS --> UI["Workbench"]
  UI --> API["API container"]
  MIG["Migration task"] --> PG[("PostgreSQL")]
  API --> PG
  API --> SM["Secrets manager"]
  API --> OS["Object storage
data rooms"]
  API --> BR["Bedrock: Claude
same AWS account"]

Runtime

Containers

The API and a migration step, with a readiness check and JSON logs carrying a correlation id.

Data

PostgreSQL

One deal schema on the platform Postgres, versioned with Alembic. Database credentials come from a secret reference, never the image.

Models

Claude on Bedrock

Haiku 5.5 for agent steps, Sonnet 5.5 for the copilot, through your AWS account. Switch either off and the product keeps working on its rules.

VerticalServe’s Innovation PODs can deploy and extend InsightDealDesk inside your environment.