Compliance

Malcolm is built for regulated industries. Here is how we handle data, privacy, and compliance.

Data handling

No PII storage

Malcolm is stateless by design. Risk data submitted through the API or MCP server is forwarded to the insurer, used to generate quotes, and then discarded. We never write end-user PII to disk, databases, or logs.

Data flow

At no point does Malcolm persist personal information. API logs retain metadata (timestamps, quote IDs, insurer names) but not the request body.

Encryption

• All traffic is TLS 1.3 encrypted in transit
• Temporary in-memory processing only - no at-rest PII storage

Regulatory

GDPR and CCPA

Because we do not persist PII, Malcolm minimises your exposure under both GDPR and CCPA. We act as a data processor under GDPR, and our Data Processing Agreement (DPA) is available on request.

AI-specific considerations

No hallucinated quotes

Malcolm returns only real quotes from licensed insurers. The structured tool interface prevents LLMs from inventing coverage terms or pricing. Every number in a Malcolm response comes directly from an insurer API.

Audit trail

Every quote and bind event has a unique ID and timestamp. You can reconstruct the full decision trail - what was requested, which insurers responded, and what was bound - using the API alone.

Human-in-the-loop

For high-value policies or unusual risk profiles, insurers may return "bindable": false and require manual underwriting review. Malcolm surfaces this clearly so your agent can set the right expectations with the end-user.

Questions?

If you have compliance questions not covered here, contact compliance@trymalcolm.com.