You do. The customer owns the claim data, fee schedules, contacts, configurations, and user records they put into Evolve. Evolution Global has a license to process that data for the limited purpose of providing the Evolve service — not to sell it, not to use it for any other commercial purpose, and not to use it to train AI models. Customer data is never used to train Anthropic, OpenAI, or Google models — that is a contractual obligation under enterprise Zero Data Retention agreements. The Master Service Agreement and the Data Processing Agreement document this in detail.
What you-own-the-data means
You retain title to the data. The customer is the data controller; Evolution Global is the data processor.
You can export at any time through the 22-method SOAP API or the standard export tooling.
You can request deletion of personal information under GDPR, CCPA / CPRA, VCDPA, and TDPSA.
You set the retention period through the MSA, subject to regulatory constraints.
What Evolution Global's license covers
Evolution Global processes the data only to provide the service:
Operating the platform — storage, claim workflow, billing, reporting, integrations.
Surfacing data to ELIAS AI in the dashboard for the customer's own questions about their own data, through providers under Zero Data Retention agreements.
Compliance reporting — Lloyd's bordereaux, AR aging, statutory reports.
Aggregated, de-identified service-improvement analytics, narrowly defined in the DPA.
What the license does NOT cover: selling customer data; training AI models on customer data; sharing data with subprocessors beyond the named list in the Privacy Policy.
Who processes the data and why
Anthropic, OpenAI, Google — process ELIAS AI conversations for the duration of the API call. Under ZDR: no retention, no logging, no training.
AWS — hosts production infrastructure. US regions. AWS-managed encryption at rest.
AWS Cognito — handles user authentication. No claim data stored.
Stripe — processes payments. Billing data only.
Drata — continuous monitoring on metadata and control evidence, not raw claim data.
Mighty Networks — hosts Conversation Insurance community. Community data only.
Xogito — service work, scoped per engagement.
At cancellation
Data ownership doesn't change. The customer's data remains the customer's data. The 30-day export window opens at cancellation; production data is deleted within 60 days per the Privacy Policy retention schedule. Some regulatory categories (billing records 7 years) follow longer-form retention.
Related questions
Can I export my data if I leave?
What does the contract actually say — what am I agreeing to?
Is my data being used to train AI models — yours or anyone else's?
How does Evolve handle claims data privacy and HIPAA-relevant information?
How secure is Evolve — what's your security and compliance posture?