Security and privacy
Health details never reach HR.
Roscoe handles benefits questions that often touch someone's health. Who can see what is decided by the database for every request, not by a setting, and the most sensitive answers never leave the secure app.
The principle
Each person sees their own part. Nothing more.
An employee's question about a scan is theirs. HR needs to know a request is moving, not why. A broker needs the change to make, not the conversation that led to it. Roscoe is built so each of them gets exactly that.
Those boundaries are row-level rules in the database. A bug in a screen, a wrong filter or a curious administrator can't widen them, because the data never comes back in the first place.
Who sees what
The same case, three views.
Follow one employee adding a dependant. Each row is a kind of information; each column is who can see it.
| Information | Employee | HR | Broker / insurer |
|---|---|---|---|
| The conversation with Roscoe | Yes | No | No |
| Health, claims and medical documents | Yes | No | Only on an approved claims route |
| The confirmed changeDependant's name and date of birth | Yes | Yes | By email |
| Who has the request and when it's due | Yes | Yes | No |
| WhatsApp numberEncrypted; looked up by a keyed hash | Yes | No | No |
| Counts for the programe.g. requests this month | No | Yes | No |
Every message is checked before it's sent.
Messaging apps are convenient and not the place for health information. Before Roscoe replies on WhatsApp, it classifies the answer. Anything about health, claims or medical documents is held back and replaced with a link to the secure app.
- General
Answered in the chat
"What's my deductible?" "Send my ID card." Answered right there, with the source.
- Personal
Answered, carefully
Requests and their progress. Only what the employee already knows, never anyone else's details.
- Health
Moved to the secure app
"Is my scan covered?" The chat gets a link; the answer waits behind sign-in.
- Always
STOP means stop
Reply STOP and messages end. Quiet hours are respected, and numbers can be removed in Settings.
How it's built
Specific controls, not assurances.
Row-level security
Every table carries per-role rules in Postgres. HR queries return only their employer's administrative rows.
Encrypted phone numbers
Numbers are sealed with AES-256-GCM and found by a keyed hash, so a database copy doesn't reveal them.
Records nobody can rewrite
Requests, renewal steps, sends and broker emails are insert-only. Corrections are new rows, never edits.
Answers with sources
Roscoe answers from reviewed policy wording and cites the page. When the wording doesn't say, it says so.
Verified messages
Inbound WhatsApp messages are accepted only with a valid provider signature. Photos and voice notes are deleted after 90 days.
An off switch
AI answers check a kill switch on every call. Each feature is switched on per employer, after review.
Where your data lives
The database and sign-in are in London. Each employer's records are its own, and a checked answer is only ever reused for people on the same plan.
Ask HR, by choice
An employee can send HR one question, which they see and confirm first. HR sees that question and nothing else of the conversation, and health details aren't sent.
What we don't claim
What isn't true yet, and what we do instead.
Your security team will ask. Here are the answers before they do.
We don't claim HIPAA compliance
No real US member's records are loaded until every provider that would hold them has signed a business associate agreement and counsel has reviewed the set-up. What we do instead is above: health details kept from HR by the database itself.
No SOC 2 report yet
Instead, the access rules are tested against every database change before it ships, and the live database's grants and policies are checked, read-only, after each one.
Roscoe can be wrong
So every answer cites the plan page, says when the wording doesn't settle it, passes a check before anyone sees it, and HR signs off a plan's answers before people rely on them.
WhatsApp isn't for health details
Meta doesn't sign business associate agreements. Health questions are answered in the secure app, and WhatsApp carries only the link to it.
Can HR read employees' conversations?
No. HR never receives conversations, claims or medical documents. The database doesn't return them to an HR account.
What happens to photos and voice notes?
They're read or transcribed to answer the question, kept for 90 days so the employee can see what they sent, then deleted. Employees can delete them sooner.
Who at Roscoe can see data?
A small team operating pilots. What they change is written to an audit log that can't be edited.
Where can we read the legal terms?
The privacy notice sets out what we process, why and for how long.
Questions from your security team?
We'll walk them through it.
We're happy to take your security and privacy review in detail, including data flows, access rules and the controls above.