Trust & Security
Security at Vega Claims
Our security program
Vega maintains a documented information security program covering access control, cryptography, data management, secure development, operations, physical security, personnel, vendor management, risk, incident response, and business continuity. Every policy has a named owner and is reviewed at least annually. The summary below describes how that program is designed; it is not a representation about any particular system or outcome.
- Encryption. AES-256 for confidential data at rest; TLS 1.2 or better in transit.
- Access. Least privilege by default, role-based, with multi-factor authentication on privileged production access and access reviewed at least annually.
- Development. Peer-reviewed code, with development and staging environments segregated from production, and a prohibition on using client data in non-production environments.
- Testing. Regular vulnerability scanning against production and penetration testing at least annually.
- Incidents. A documented response plan with defined severity levels and escalation paths. The plan is reviewed and tested at least annually.
- Continuity. Encrypted daily backups with regular restoration testing, documented recovery objectives, and a distributed workforce that keeps claims handling running when a single location or region is disrupted.
- People. Confidentiality agreements for staff and contractors, with security awareness training at hire and annually thereafter.
- Vendors. Risk assessment and an executed agreement before any confidential data reaches a third party.
SOC 2 examination
- Examination
- SOC 2 Type I
- Status
- In progress
- Next
- Type II examination to follow
A SOC 2 Type I examination of our security program is currently in progress. When each report is issued, it will be made available to clients and prospective clients under NDA, alongside our control detail and subprocessor list.
Reporting a security concern
If you believe you have discovered a security vulnerability in a Vega Claims service, we want to know about it. Report it to [email protected] and we will acknowledge your email promptly and work to resolve the issue.
This is not an authorization to test
These instructions explain how to report a vulnerability you have already discovered. They are not an invitation to probe Vega Claims systems, and they do not grant permission to conduct security testing against our infrastructure, our applications, our clients’ data, or our vendors. Unauthorized testing may violate our terms of use and applicable law.
Clients and prospective clients who require authorized testing as part of their own diligence should contact us first so that scope can be agreed in writing.
If you do report something
- Give us a reasonable amount of time to resolve the issue before disclosing it publicly or to a third party.
- Make a good faith effort to avoid violating privacy, destroying data, or interrupting or degrading the Vega Claims service.
- Only reference accounts you own, or for which you have the account holder’s explicit permission.
Changes to this procedure
We may revise this procedure from time to time. The most current version is always published on this page.
Security documentation
Clients and prospective clients running security diligence can request our policy documentation, business continuity plan, and audit materials under NDA by writing to [email protected].
This page describes Vega Claims’ information security program for an external audience. It is a summary, not a contract or a warranty, and it does not modify the terms of any client agreement. Where this page and an executed agreement differ, the agreement governs.