Doux gives an agency a team of agents that can genuinely act inside its systems — which means security cannot be an afterthought. Your instance runs isolated, against your own credentials, and those credentials never leave your environment. The model never executes anything itself, and every action is written down. You get the capability without having to become a security engineer.
Isolated per tenant · your credentials never leave your environment · every action on the record
Plenty of vendors open a security page with an attack they survived. We are early, and we are not going to dress up numbers we have not earned. Here is what we can actually stand behind — the architecture, not a scoreboard.
Claude is the foundation Doux runs on, and you can absolutely run it yourself. Doing so hands you full control — and with it, full responsibility for the isolation, the guardrails and the audit trail. Doux ships that same foundation already fitted to a commercial P&C agency, with the boundaries built in.
| Claude, self-hosted | Doux | |
|---|---|---|
| Your data stays in your environment | Yes | Yes |
| You control what the agents can reach | Yes | Yes |
| Knows commercial P&C — forms, endorsements, x-dates | You build it | Built in |
| Drives your management system and carrier portals | You build it | Built in |
| Deterministic action layer — the model cannot execute | You build it | Built in |
| Approval queue for irreversible actions | You build it | Built in |
| Append-only audit record of every action | You build it | Built in |
| Per-tenant isolation and key separation | You build it | Built in |
| Writes read back and verified after every change | You build it | Built in |
| Fitted to your agency's own rules | You build it | Built with you |
Every row above describes Doux as it is built today. Where something is still in progress we say so on this page rather than in a tick box.
Security is not one wall. Each card below has the plain-English version on top and what it actually means underneath.
The logins for your management system, your carrier portals and your mailbox live in your own tenant environment. We do not hold a copy, and no other tenant's instance can reach them.
The language model emits a label from a closed list of permitted actions. It never writes a command, never names a recipient, and never touches your systems directly. A deterministic router decides what actually happens.
Anything that leaves the agency, changes coverage, or cannot be undone stops and asks a named human. Approval is checked against a roster — not against a field that merely contains a name.
What was done, by which agent, on what evidence, and who approved it. Entries are appended and chained — an earlier entry cannot be quietly rewritten later.
Management systems can commit a record and then fail while answering. Doux never treats an error as a failed write — it reads the record back and confirms the real end state before reporting anything as done.
An email, a contract exhibit or a carrier notice is treated as material to read, never as a command to obey. Because the model can only emit a label from a closed list, a crafted message has no verb available to it.
Sensitive actions pause for a yes or no, with the evidence attached — from your phone, in a couple of minutes a day.
Approve the same call enough times and Doux offers to handle that one. You confirm once, explicitly. Everything outside those rules keeps coming to you.
Every action, its evidence, and the person who authorised it. When the E&O question comes, the answer is a record rather than a memory.
Nobody can promise a language model will never be talked into something by a cleverly worded message. So we do not rely on the model behaving. It is fenced in by what it is structurally able to do: a closed list of actions, a deterministic layer that owns every destination, approval gates on anything irreversible, per-tenant isolation, and an audit record. If something does go wrong, it is contained, logged and visible.
And the honest status line: a formal security programme is in progress. We do not hold SOC 2 and we do not claim it. Ask us where it stands and we will tell you exactly, in writing.
Isolated, credential-safe and on the record from the day it is installed.