Insurance & claims Policyholder & health data

Claims and policyholder data don't belong in an AI prompt.

Underwriters, claims handlers and brokers use AI to draft a letter or summarise a file. Every paste can carry personal data, health data included, out of your control. Tracehold checks what is sent to AI tools and, according to your policy, observes, warns, redacts or blocks. If nothing sensitive is found, the prompt goes through.

Request a demo See the risk

Detection runs in the browser Governance reports mapped to GDPR, NIS2, DORA and the EU AI Act Built & hosted in the EU

claims assistant — caught on paste

REC-INS-07 · ON-PASTE SCAN · BLOCK

A claims handler is about to send this to an AI tool:

Policyholder PII

a national ID number and bank details (IBAN)

Health data in the claim

an ICD-10 diagnosis code, a health card number

Block

Blocked before it is sent

the handler is told why

In the browser

Where detection runs

The extension’s engine checks the prompt and attached files before they are sent to an AI tool.

Metadata first

What reaches the console

Event metadata (type of data, severity, destination, action) plus a masked sample of the value. Saving the content is off by default.

1,600+

Detection rules

For data with a recognisable shape: ID numbers, IBANs, ICD-10 codes and health card numbers.

Built and hosted in Europe

Tracehold is built in the EU and EU-hosted.

[ The risk in insurance · observe ]

A claim file is some of the most sensitive data you hold

Insurance runs on identity, finances and health. AI tools make the work faster and make it easy to send that data somewhere it should never go.

Claims narratives

Handlers paste whole claim notes into AI to draft a response or summarise a file, carrying the claimant's circumstances, injuries and account of events into a third-party tool.

Policyholder PII

Names, addresses, dates of birth, policy and national ID numbers and bank details end up in prompts when staff ask AI to reformat a quote, a letter or a renewal.

Health & special-category data

Life, health and personal-injury claims are full of medical reports and diagnoses. Under GDPR that's special-category data, and one careless paste is exposure you want to catch before it leaves.

The honest version: Blocking AI outright tends to push people to personal devices or unapproved apps, where you have no visibility. Tracehold lets teams keep using AI while it checks what is about to leave, and Observe mode shows you what is going out before you enforce anything.

[ See · decide · protect · record ]

Checked in the browser, before it reaches the AI

The extension checks what is about to be sent, before it goes. The console receives event metadata plus a masked sample of the value, not the claim.

See

The moment a handler is about to send claim text to an AI tool, Tracehold checks it, before it is sent.

Decide

Rules recognise ID numbers, IBANs, ICD-10 codes and health card numbers, and your policy decides what happens. Free-form prose needs the optional LLM classifier (Governance plan, beta).

Protect

The sensitive part is redacted so the rest of the request can still go through, or the whole paste is blocked, and the handler gets a clear, in-context explanation.

Record

Your compliance team gets a record of each finding: type, severity, destination and action, with a masked sample of the value. Saving the content is off by default.

Allow Observe Redact Block

What reaches the console: event metadata (type of data, severity, destination, action) plus a masked sample of the value. Saving the content itself is off by default.

[ Surfaces · everywhere your people work ]

Across the browser and the desktop

Claims and underwriting work doesn't only happen on AI websites. The browser extension recognises more than 300 AI-tool domains with more than 1,600 rules, and endpoint agents reach beyond the browser.

Free browser extension

Chrome, Edge and Firefox. Checks the prompt and attached files on AI sites, and tools nobody has approved show up as shadow AI in the console.

Desktop & developer agents

The Windows agent covers USB drives, printing and screen captures of protected Office documents. The Linux agent covers terminal AI tools such as Claude Code and Codex, when the policy turns it on. Neither intercepts the network by default.

Claim files already on disk

The Windows agent can scan files on demand and the Linux agent has an optional local scanner. On AI sites, attached or uploaded files get the same check as pasted text.

Detection runs in the browser

The extension’s engine checks the prompt and attached files before they are sent, and needs no proxy. The console receives event metadata (type of data, severity, destination, action) plus a masked sample of the value, not the claim. Saving the content is off by default.

If your organisation turns on the optional LLM classifier (Governance plan, beta), the text travels in transit to the classifier and Tracehold does not store it. Endpoint agents send an excerpt of the text with the sensitive values masked. See how we protect your data →

[ Compliance for insurers · GDPR · NIS2 · ISO 27001 · SOC 2 ]

Compliance evidence for the rules you answer to

In the Governance plan, Tracehold maps what it finds to 39 controls across six frameworks (GDPR, the EU AI Act, DORA, NIS2, ISO 27001 and SOC 2) and exports a report for each, in PDF or CSV. It supports your audits; it is not legal advice or a certification.

GDPR

10 controls mapped. Art. 9, special-category data (health data is exactly that), Art. 32, security of processing, and Art. 33, evidence of exposure that could be a breach.

ISO 27001

6 controls mapped. Annex A 8.12, data leakage prevention, and 5.14, information transfer.

SOC 2

5 controls mapped. CC6, logical access, and C1, confidentiality.

NIS2

4 controls mapped. Art. 21, risk management, and Art. 23, incident notification, with indicative deadlines tracked per incident; nothing is notified to an authority automatically.

Support for your audits, not a certification. The mapping is a product judgement about which detections evidence which obligation. Review it with your compliance team. See compliance in depth →

On certifications, to be precise: Tracehold does not claim ISO 27001, SOC 2 or any other certification. What it gives you is evidence and reports mapped to those frameworks, to support your own audits.

[ Deployment · no proxy ]

Rolled out with the tools you already run

No proxy, no network surgery. The browser extension needs no proxy and no network change, and you push it with your usual device management.

Single sign-on

SIEM & alerting

Findings from the browser extension go to your SIEM over HTTPS (Splunk HEC or CEF), and alerts go to Slack, Microsoft Teams or your own webhook URL.

Push it with MDM

The console generates the managed-policy files (.reg, .ps1, .json) and the MSI, and there is a guide for Microsoft Intune. Your MDM or GPO does the rollout.

Start in observe-only mode

Watch and report without blocking anyone. You see what would have been caught and where your real exposure is before you turn on warnings, redaction or blocking.

Start in Observe and nothing is blocked while you measure your exposure.

[ Plans ]

Three plans, one path

The free extension needs no account and is for one person. Move up when you need central visibility, policies and governance.

Free

The free browser extension needs no account and is for one person. It has no console and no policies.

See what's included

Insight

Visibility and prevention: detection, Shadow AI discovery, the console, policies to block, warn or redact, file scanning, your own rules and alerts.

Compare plans

Governance

Everything in Insight, plus compliance risk and audit-ready reports mapped to GDPR, NIS2, DORA, the EU AI Act, ISO 27001 and SOC 2, multi-tenant spaces and the LLM detection engine (beta).

Talk to our team

[ FAQ · what insurers ask ]

What insurers ask us

Does the claim text or the medical report leave our environment?

Detection runs in the browser. The console receives event metadata (type of data, severity, destination, action) plus a masked sample of the value, not the claim. If your organisation turns on the optional LLM classifier (Governance plan, beta), the text travels in transit to the classifier and Tracehold does not store it. Saving content is off by default. Endpoint agents send an excerpt of the text with the sensitive values masked.

Can Tracehold detect health data?

Partly, and it is worth being precise. The rules recognise ICD-10 diagnosis codes, NHS numbers, European and Spanish health card numbers and a named mental-health diagnosis next to personal data such as an ID number. A medical report in plain prose with none of these has no shape a rule can match; for that, Governance adds the optional LLM classifier (beta). Under GDPR health data is special-category data, so start in Observe and see what your teams actually send.

Which frameworks does the compliance mapping cover?

The Governance plan maps findings to 39 controls across GDPR, the EU AI Act, DORA, NIS2, ISO 27001 and SOC 2, with a report for each in PDF or CSV. It supports your audits; it is not legal advice or a certification.

Does Tracehold hold any certification?

Tracehold does not claim ISO 27001, SOC 2 or any other certification. What it gives you is evidence and reports mapped to those frameworks, to support your own audits.

Won’t this just push staff to use AI on personal devices?

That is why Tracehold doesn’t simply ban AI. Your teams keep using the tools that make claims and underwriting faster while Tracehold checks what is about to leave, and tools nobody has approved show up as shadow AI in the console, so you can see them.

How is it rolled out, and which plan do we need?

You push the browser extension with your usual device management: the console generates the managed-policy files (.reg, .ps1, .json) and there is a guide for Intune. Start in Observe to see what your teams send. Insight and Governance are priced per user, with a budget tailored to your team. Compliance reports and the LLM classifier are part of Governance.

See what your teams are sending to AI today

Book a demo and start in Observe: see what claim, policyholder and health data is going into AI tools across your business, with zero disruption to your people.

Request a demo See pricing