The telemetry contract is annexed to every Castra binder. It enumerates exactly what the insured agrees to transmit, the cadence, and the retention. It is bidirectional — we commit to what we will not ingest as firmly as to what we will.
Castra ingests metadata describing the insured's AI deployment under the telemetry contract — specifically the action audit, classification stability signal, and dependency graph described below. Castra does not ingest raw model inputs (prompts, queries, or source documents), raw model outputs (free-text responses or generated content), model weights, training data, or end-user personal information. The action audit records categorical metadata about each consequential action — timestamp, model version, input class, decision class, and downstream effect — sufficient to reconstruct a claim without reading the underlying interaction. The audit ledger is held by the insured and made available under defined claim-readiness conditions; we do not stream it.
Data is transmitted over mutually authenticated TLS or, for batch submissions, SFTP against a per-cedant key. Retention defaults are listed below. The insured may shorten any retention period; the underwriting price will adjust accordingly. SOC 2 Type II controls are maintained by our processing vendor; the report is available to brokers and treaty counterparties under NDA.
Data residency: US-East and Frankfurt by default. Other regions on request. Castra does not transmit telemetry outside the residency region.