Skip to main content
Security & data

Your data stays in your environment. Here is exactly how.

Opswell builds automations inside your Claude workspace and your systems. We do not move your data into Opswell-owned production systems. This page is the written answer your IT, InfoSec, and counsel will ask for.

Principles

Least privilege. Human sign-off. Full audit trail.

Your tenant. Work runs in your Claude / Anthropic organization and your apps — not an Opswell multi-tenant vault.
Least privilege. Named users or service accounts with the minimum scopes required; access revoked at handover.
Human in the loop. Nothing posts to the GL, ERP, or CRM unreviewed unless you explicitly approve an exception in writing.
Audit trail. Preparer / reviewer / approver separated where controls require it; change history retained.
Claude & licensing

Why Claude — and what you pay Anthropic.

Claude is Anthropic's AI model. We build on it because it is strong at long documents, spreadsheets, and careful reasoning — the work finance and operations actually do. We are independent and not affiliated with Anthropic.

Plan requirement. Client work should run on Anthropic's Team or Enterprise (or equivalent commercial) plans with data-use settings that match your policy — typically no training on your prompts/outputs. Consumer / free plans are not appropriate for production client data.

You carry the Claude license. Ongoing model usage is billed by Anthropic to your org. We size expected usage during scoping; it is usually a small fraction of the labor we displace.

Already on Copilot or ChatGPT? That is fine for day-to-day productivity. Our builds are Claude-native. We can discuss bridges and whether a dual-stack makes sense; we will not force a rip-and-replace of your desktop AI.

Access model

How Opswell gets in — and how we get out.

  1. NDA / MSA first (your paper or ours).
  2. Kickoff on sample files and screen-share before standing credentials.
  3. Then least-privilege access: SSO where available, named accounts preferred over shared passwords, MFA on.
  4. Connectors (ERP, CRM, storage) scoped to the processes in the Statement of Work.
  5. At handover: credentials revoked, documentation left with your team, optional knowledge-transfer session.
Healthcare · HIPAA

PHI and Business Associate Agreements.

Healthcare engagements that touch claims, EOBs, eligibility, or other PHI require a Business Associate Agreement before PHI is processed. We will sign a BAA when the engagement and Claude configuration support it. If your Claude / Anthropic setup cannot cover PHI under your policy, we redesign the scope to stay outside PHI (e.g., de-identified extracts or finance-only processes).

GovCon · CUI

Controlled Unclassified Information.

We do not process CUI in Claude or any cloud AI tool unless your security officer has approved a compliant environment and data flow in writing. Default stance: keep CUI in your authorized systems; use Opswell on non-CUI finance/ops processes (or sanitized extracts). We work with Deltek Costpoint, Unanet, and related GovCon stacks when scoped. CMMC / FedRAMP questions are answered in the security questionnaire for your engagement — ask for it.

Subprocessors & site tooling

What touches your data when you use this website.

The marketing site uses HubSpot (forms / CRM), Google Tag Manager (analytics), and Google Calendar (booking). Engagement work itself uses Anthropic Claude in your tenant plus whatever systems you authorize (ERP, CRM, storage). We do not sell or share prospect or client data.

Insurance & entity. Legal entity details, W-9, and certificates of insurance are available on request for procurement — email hello@opswell.ai. We do not currently hold SOC 2; engagements run in your Claude tenant and systems under NDA / MSA, with least-privilege access revoked at handover. Security questionnaire answers and outline paper (NDA, MSA, DPA) are on Enterprise & procurement.

Who we serve. AI automation for companies roughly $10M–$500M revenue (and PE-backed portcos in that band); finance leadership from about $2M / Series A onward. Larger buyers: see Enterprise & procurement for the vendor pack, SOX stance, and delivery model.

FAQ

Common questions

Where does our data live during an engagement?

In your Claude workspace and the systems you authorize — not an Opswell multi-tenant vault. Access is least-privilege and revoked at handover.

Do you support HIPAA / BAA and CUI?

Healthcare PHI needs a BAA first. CUI stays out of cloud AI unless your security officer approves in writing.

Can we get a vendor / procurement pack?

Yes — NDA, MSA/DPA outlines, security questionnaire summaries, and COI instructions. See Enterprise & procurement.

Next step

Send your questionnaire. We answer in writing.

Usually within one business day. Prefer paper first? Request the vendor pack while a Snapshot runs.

Need the full vendor pack (NDA, MSA/DPA outlines, COI)? Enterprise & procurement ›