Commander for Advocates · security
Security and data handling for firms
What happens to your clients' claims files, medical records, and Social Security numbers once they are in Commander for Advocates. Only what is in place today, in plain words, for the person at your firm who has to sign off.
Where your clients' files live
- The advocate workspace runs on Amazon Web Services in the United States (the us-east-2 region, Ohio), separate from the public website.
- Client records and case data are kept in an Amazon RDS PostgreSQL database that is encrypted at rest with a dedicated AWS KMS key and is not reachable from the public internet.
- Uploaded documents, such as claims files, decision letters, and medical records, are kept in private Amazon S3 storage, encrypted with the same key, with every form of public access blocked.
- A client's date of birth and the last four digits of the Social Security number are encrypted again in the application, with AES-256-GCM, before they are saved.
- Every connection is encrypted in transit (HTTPS/TLS).
- Storage and hosting for the workspace are covered by a signed HIPAA Business Associate Agreement with AWS.
Who can see what
- Each organization sees only its own clients. Nothing in one firm's workspace is visible to another firm.
- Three roles: Admin, Member, and Viewer (read-only). Admins invite staff and change roles in Settings.
- An optional setting, "members see only assigned cases," limits each non-admin login to the veterans assigned to them. A case someone may not open reads as not found, not as forbidden.
- Staff logins are free and unlimited, so nobody has to share a login to save money.
- Before any veteran's records can go in, we check the organization against VA's accreditation directory. A name-and-state match is confirmed automatically; anything else is reviewed by a person.
- Payments run through Stripe. We never see or store card numbers.
A record of what happened
- Every case has a diary of what was done on it, such as uploads, signature requests and signatures, and filings, written at the moment each happens. Entries are never edited afterward.
- Diary entries name documents and forms, not medical content or Social Security numbers.
- Error reports are scrubbed of record content and identifying fields before they leave our servers. Personal and medical information is not written to logs or analytics.
AI and your clients' data
- Client data is never used to train AI models.
- Drafting and analysis use Anthropic's Claude API. Under Anthropic's API terms it does not train on what we send, and it may keep requests for up to 30 days for safety and abuse monitoring. We have not enabled zero data retention with Anthropic; if that changes, the privacy policy will say so.
- File search uses Voyage AI embeddings. We opted out of Voyage AI's use of customer content for training, effective September 6, 2026, and text sent since then is deleted by Voyage AI right after it is processed.
- Scanned pages with no readable text are read by Amazon Textract inside our AWS account. Our AWS account opts out of AWS using content from its AI services to improve or train them.
- What the file reader finds is cited by document and page, so the representative can check it against the record. Every draft is reviewed, edited, and signed by the representative. The software does not represent veterans.
Retention, deletion, and leaving
- A client's records and work product are kept until the representative deletes the document or the client, or the organization closes its account.
- If no one in an organization signs in for 24 months, we may email a reminder. We do not delete a firm's records automatically for inactivity.
- To close the organization and purge everything it holds, the organization's admin emails support@vaclaimcommander.com with the subject "Delete our organization." Deletion requests are completed within 30 days, including removal from backups.
- Encrypted database backups are kept for 7 days and then expire.
- You can export the client roster as a spreadsheet (CSV) and download any document in a case file. If you cancel, your documents stay downloadable.
- Document storage is an organization-level setting the firm controls.
Subprocessors
Every outside service that can touch an advocate firm's data. Each works for us under a written agreement and may not use the data for its own purposes. The privacy policy has the full text.
| Service | What it does |
|---|---|
| Amazon Web Services | Hosting, database, document storage, encryption keys, and Amazon Textract for scanned pages, under a HIPAA Business Associate Agreement |
| Anthropic | AI drafting and analysis (Claude API); no training on our data; up to 30 days' retention for abuse monitoring |
| Voyage AI | Search index of record text; training opt-out since September 6, 2026; deleted after processing |
| Clerk | Sign-in: email address and authentication identity |
| Stripe | Billing; card numbers never reach us |
| Resend | Email delivery (intake links, notices); no medical records or document content |
| Sentry | Error reports, scrubbed of record content and identifying fields |
| Vercel | The public website only; the advocate workspace does not run there |
What we do not have
- We do not have a SOC 2 report or any other third-party security certification today.
- We have not enabled zero data retention with our AI provider (see above).
Questions from your firm's security reviewer go to support@vaclaimcommander.com. The privacy policy is the binding text; this page summarizes it.
Questions
What firms ask
Where is Commander for Advocates data stored?
On Amazon Web Services in the United States (us-east-2, Ohio): case data in an encrypted Amazon RDS PostgreSQL database that is not reachable from the public internet, and documents in private, encrypted Amazon S3 storage, under a HIPAA Business Associate Agreement with AWS.
Is client data used to train AI?
No. Anthropic does not train on API data under its terms and may keep requests up to 30 days for abuse monitoring; we opted out of Voyage AI training effective September 6, 2026; and our AWS account opts out of AWS AI services using content for improvement.
Can I limit staff to their own cases?
Yes. Turn on "members see only assigned cases" and each non-admin login can open only the veterans assigned to it. Viewer is a read-only role. Admins always see every case.
Do you have SOC 2?
Not today. We do not hold a SOC 2 report or any other third-party security certification. This page lists what is in place instead. Send any security questions to support@vaclaimcommander.com.
What happens to our data if we leave?
Documents stay downloadable after you cancel, and you can export the client roster as a CSV. To purge everything, the organization's admin emails support@vaclaimcommander.com with the subject "Delete our organization"; it is completed within 30 days, including backups, which expire after 7 days.
Choosing software? How to choose VA claims software has the questions to ask any vendor, and Using AI in a VA practice covers ABA Formal Opinion 512.
Try it on your own cases
5-day free trial, no card required. Staff logins are free.
Not affiliated with or endorsed by the Department of Veterans Affairs. VA Claim Commander is software, not a VSO, law firm, or accredited representative.