How it stays honest

An AI that can't make up a number.

The analyst reasons freely — it reads your book, forms a judgment, argues for it. But in a regulated numbers business the dangerous failure is the confident fabrication. Here is exactly how Credence makes that impossible.

Principles

The four rules every output obeys

01

The AI reasons; it never does the arithmetic

The analyst decides what matters and why — but every number it cites is produced by deterministic, inspectable code: chain-ladder, Bornhuetter–Ferguson, Mack, ODP bootstrap. The model is handed engine-computed facts and reasons over them; it is never the source of a figure. Judgment from the AI, arithmetic from the engine.

02

A guard checks every number the AI writes

Before you see the analyst's note, every figure in it is matched back to an engine value. A number that doesn't trace — a hallucination — is flagged, not presented as fact. You see "✓ all figures trace to the engine" on answers that pass. Fabrication is caught by construction, not by trust.

03

Same inputs, same answer — forever

All simulation is seeded (seed 8841 in the public workbench); every run carries a run-hash. Re-run a result in front of a regulator years later and the numbers will not move. See the reproducibility contract.

04

The actuary holds the pen

Credence drafts; a credentialed human signs and remains accountable. Sign-off lines in generated memos are blank by construction. This is the Bühlmann formula applied to the product itself: machine scale weighted with human judgment.

Reproducibility

The contract, verifiably

The public workbench validates its engine against the published literature: on the Taylor–Ashe (1983) triangle it reproduces Mack (1993)'s chain-ladder total of 18,680,856 and total standard error of 2,447,095. That validation runs in your browser — you don't have to take our word for anything on this page that has a number in it.

Simulation uses a fixed-seed PRNG with common random numbers across compared alternatives, so a delta between two decisions is pure decision effect, never sampling noise.

RUN-HASH SEMANTICS

Every computed result carries a hash of its outputs. Identical inputs + identical engine version ⇒ identical hash. A changed hash means something real changed — data, assumption, or method — and the lineage shows which.

credence-9fp.com/product.html
The workbench computation log timing each engine step — cumulate, chain-ladder, Bornhuetter–Ferguson, Mack standard errors, ODP bootstrap (seed 8841) — and emitting run-hash cdfd8cb7, 're-run and it will not change'

The workbench's own log — every engine step, timed, ending in a run-hash. Re-run the same book and the hash, and the numbers, don't move.

Model governance

Mapped to the rules that govern you

NAIC AI Model Bulletin

Adopted December 2023 and spreading across US jurisdictions: insurers must govern, document, and audit their AI. Credence's lineage-first architecture is designed so that using it is complying — outputs arrive pre-documented.

ASOP 41 & 56

Actuarial communications and modeling standards: disclosure of methods and assumptions, model understanding, reliance documentation. Drafted memos follow ASOP 41 structure; every model run is disclosed down to its parameters.

EU AI Act (context)

Risk-assessment models in insurance are classed high-risk, with transparency obligations. Credence targets US P&C first, but the architecture meets the stricter bar by default — glass box travels well.

Security & data

Where your data lives

The public pages: the workbench and Scenario Library run entirely in your browser — no accounts, no telemetry; a pasted triangle is parsed locally and never transmitted.

The workspace (accounts): books and runs you choose to save are stored server-side in a per-account private database, readable only through your authenticated session. Sessions are HttpOnly cookies whose tokens are stored server-side only as hashes; passwords are salted PBKDF2-SHA256; sign-in with Google (OIDC) means we never see a password at all. Deleting a book — or your account — deletes the data, immediately and completely.

As the platform scales: single-tenant isolation options, audit logging from day one, SOC 2 Type II pursued alongside the first carrier deployments — not after them. Security documentation ships to founding partners before any data does.

FOR YOUR PROCUREMENT TEAM

Need the details in writing? Security and model-governance documentation ships to founding partners before any data does — book a working session and ask for the pack.