MarvelX

Case documents are collected from the insurer's systems, and each decision is written back into them. Inbound: "Your documents arrive. Upload them, or we collect them straight from your systems", so the platform reaches into the insurer's systems to fetch case material rather than waiting to be fed. Outbound: "once the output is delivered to your system, the data is wiped from ours."

The decision is written back into the customer's system of record as the normal course of operation, and the vendor's zero-retention design depends on that write-back, which makes it stronger evidence than a general claim about integration. ClaimOS MaX, the earlier product, was described as integrating legacy and modern insurance systems, connecting to current tools quickly, updating the claims or case management system automatically and integrating through APIs and webhooks.

Integrations is a named platform component with its own page, listed again on the trust center under Product Security, so it is governed as part of the product rather than offered as professional services.

The counterparty class is the hard one in this market: claims and policy administration systems are the legacy estate that makes the category difficult, and the older site promised to "connect with your current tools and systems in minutes, not months." A cloud marketplace listing is a purchase channel, not an integration.

No named counterparty system, connector catalog or protocol is confirmed; what is documented is the two way flow with the customer's systems.

Sourcemarvelx.ai home solution pipeline and security sections, platform navigation, trust.marvelx.ai product security sectionread 2026-09-14

The claims flow is published as a numbered pipeline, run by distinct agents under rules the insurer writes.

The case moves through five stages: documents arrive by upload or collection from the customer's systems, the case is read whole with "Every field scored", and the agents then decide on coverage, fraud and settlement, where "every conclusion cites its source", before an expert gate and improvement in the Agent Gym.

Extraction, reasoning across policy and evidence, three distinct decisions and then approval add up to conditional, multi stage execution rather than a single model call, and the worked example of fourteen documents for one claim shows the fan in the sequence handles.

The agents are named in the product architecture: AI Agents and Workflows are separate platform components, and the solutions pages name five agent functions, among them Data Extraction, Claims Processing and Fraud Detection, across the claims lifecycle.

The composition belongs to the customer: "held to your rules: same result, every time", with a published customer account describing an agent "customized to our specific products". Rules the insurer authors, applied deterministically, are orchestration configured rather than hard coded. No orchestration runtime is named, and no workflow graph or versioning is described.

Sourcemarvelx.ai home solution pipeline, platform and solutions navigationread 2026-09-14

Each claim decision is grounded in that case's own documents, with every conclusion citing its source, but no knowledge store survives between claims. The published pipeline is document-bounded: "Your documents arrive. Upload them, or we collect them straight from your systems", then "AI reads the whole case. Policies, photos, invoices, handwriting. Every field scored", with the worked example naming "fourteen documents" for "one claim". The grounding is real and provenance-tracked, since "every conclusion cites its source", and citing source documents is genuine grounding.

There is no maintained structure to add customer knowledge to. The home page states "zero data retention": "we process claims in a transient state. Once the output is delivered to your system, the data is wiped from ours."

A product that wipes the data after delivering the output assembles context per claim and discards it rather than maintaining a retrieval structure over the customer's knowledge, by the vendor's own design choice rather than by omission. No vector store, index or retrieval layer is named anywhere on the vendor's own site.

The Vault, a named platform component, is the one place a persistent document store for a customer could live, and it is not described. The domain specific models are trained on insurance data, which is training rather than retrieval.

Sourcemarvelx.ai home solution and security sectionsread 2026-09-14

An expert approval gate stands before each decision goes out, with uncertain cases routed to a person under rules the insurer writes. The home page states it twice: "Every approval passes your gate", and in the five-step pipeline as step four, between the decision and the outcome: "Your experts agree. Held to your rules: same result, every time.

Doubt goes to a person", captioned "Your rules" and "not a model". An explicit routing of uncertain cases to a human, with the customer's rules rather than model judgment deciding, is a shipped review-and-approve surface, and it is a gate before commit rather than control after it.

The commitment is consistent across the site. The hero promise is "drive claim costs down to 1 euro while keeping your experts in control", and the older security page carries a human-in-the-loop tile reading "maintain control where it matters and make sure automation never sacrifices oversight."

Human specialists shift from manual entry to orchestration and quality control, and the vendor's economics, with experts focused on the exceptions rather than the routine, only work if exceptions actually reach them. A command center for reviewing decisions, with anomalies flagged for human review, appeared on the previous site and is not in the current navigation.

No approval queue interface, escalation matrix or configurable threshold is documented; the gate is known from repeated first party commitments and its place in the pipeline.

Sourcemarvelx.ai home hero and solution pipeline step 04, marvelx.ai/security human-in-the-loop tileread 2026-09-14

A scoped ISO 27001:2022 certificate with its statement of applicability is published, alongside SOC 2 attestation and named access and data controls.

The trust center names the certified entity, the standard version, the certifying body and the scope: "MarvelXai B.V. holds an ISO/IEC 27001:2022 certification for its ISMS, covering the development, deployment, and management of AI-driven software solutions for the finance and insurance industry, including data privacy management and processes supporting responsible AI development and deployment", with Certi-Trust named as the body and an ISO 27001 statement of applicability published as a document.

A scoped certificate with an SoA says what was certified, not merely that something was. The trust center also lists SOC 2 Type 1 ("we undergo annual SOC 2 Type 1 reporting"), Type 2, AIUC-1 and GDPR, with documents behind an access request. The security page itself states SOC 2 Type I attested.

Access controls are named too: the trust center's Access Control section lists access log management and automated account management, the published policies include an access control policy, and Data Security names access monitoring, data asset classification and certificates of destruction. A second data control on the home page is unusually strong: "zero data retention, your data is yours. We process claims in a transient state.

Once the output is delivered to your system, the data is wiped from ours." The vendor runs on AWS, GCP and Azure, with attestation reports reviewed annually, which speaks to the host rather than to MarvelX. No single sign on, SAML or role based access control is named as a product feature anywhere, the one gap in an otherwise deep surface, and the certificate documents themselves are gated.

Sourcetrust.marvelx.ai overview, compliance, product security, access control and data security sections; marvelx.ai home security section; marvelx.ai/securityread 2026-09-14

Audit logging is a listed product feature, and every conclusion the agents reach carries its source. The trust center places audit logging under Product Security alongside Data Security and Integrations, as a property of what the customer buys rather than of how the vendor runs its office; the Continuous Monitoring section adds event and audit log management, and the Access Control section adds access log management.

The record of each run is specific to this product: "every conclusion cites its source", stated twice on the home page, with the pipeline summarized as "from messy documents to an audited decision". A decision that carries the document and field it was derived from is a reconstructable run, a record of why this agent decided this rather than a dashboard of throughput.

The company's strapline is "the audit-ready AI workforce for modern insurance carriers and TPAs", and on a regulated claims product the audit trail is the thing being sold. What is logged and cited is the agent's decision on a claim; the fraud monitoring the agents perform on the customer's transactions is the product's output, not a record of the agents.

A command center dashboard with a transparent audit trail on every claim appeared on the previous site and is not in the current navigation. No log schema, retention period, export path or SIEM integration is documented, and the trust center lists the capability by name without describing it.

Sourcetrust.marvelx.ai product security and continuous monitoring sections, marvelx.ai home solution sectionread 2026-09-14

Nothing persists on the vendor's side, and it says so outright: claims data is wiped once the decision is delivered. The home page sells it: "Zero data retention, your data is yours. We process claims in a transient state. Once the output is delivered to your system, the data is wiped from ours." The trust center points the same way, listing certificates of destruction under Data Security. The absence is visible in the vendor's own words rather than inferred from a silent site, and for an insurance buyer it is a deliberate design choice meant to reassure.

No memory layer is documented by any route: no session state, no durable agent-written artifact, no scope, lifetime or expiry, and no carry-over between claims. The claim that agents "learn and improve over time, adapting to new data and regulatory requirements" is absorbed learning in a model, not context an agent reads back. There is no conversational surface either: work arrives as documents from the customer's systems, not as a user turn. A vault in a zero retention design is more likely a credentials or document transit store than an agent memory.

Sourcemarvelx.ai home security section, trust.marvelx.ai data security sectionread 2026-09-14

Customers each get a private, isolated cloud environment of their own, but no regions, no option to run in the customer's own account and no way to choose are published. The home page reads "Private deployment sovereignty guaranteed. We deploy MarvelX in a private, isolated cloud environment dedicated to your organization." The subject is the vendor, and the environment is dedicated to the customer rather than owned by them. A dedicated tenancy is a real step above shared multi tenant SaaS.

No region is named anywhere, no option to deploy into the customer's own account or data center is documented, and there is no residency menu. The trust center states only that the vendor leverages providers "like AWS, GCP, and Azure", which describes the vendor's supply chain rather than a customer choice.

A published customer account reads "MarvelX allowed us to develop and deploy an AI claims agent, customized to our specific products, trained on our own data, and running in our own environment within weeks"; a customer's phrase in a testimonial is not a documented deployment option, and it sits on the same page as the vendor's own sentence describing the opposite shape.

Sourcemarvelx.ai home security section and customer account, trust.marvelx.ai operational security sectionread 2026-09-14

Five named agent solutions each have their own page, but on a single workflow product several look like stages of one pipeline rather than agents a buyer adopts separately. The footer of every page links them, each on its own durable URL, alongside a platform level AI Agents page. The product has also been described as shipping prebuilt insurance agents for claims assessment, fraud detection and customer communication, plus reusable templates such as compliance report templates, rather than a broad user-composable catalog.

Whether those five are agents a buyer selects among, or five descriptions of what one claims platform does, is not settled by anything published. On this product the second reading is live: Data Extraction, Claims Processing and Report Generation are consecutive stages of the same published pipeline rather than alternatives, and removing one would break the others. Customer Support and Fraud Detection are the two that look separable. Either way, these are named, prebuilt, domain specific agents shipped as product.

Sourcemarvelx.ai solutions navigation read across two pages, home solution pipelineread 2026-09-14

Work starts when case documents arrive, including documents collected from the insurer's systems with nobody at a screen, and it runs around the clock. The first step of the published pipeline reads "Your documents arrive. Upload them, or we collect them straight from your systems."

Collection straight from the insurer's systems is work reaching the agent without a person, and upload is the alternative rather than the requirement. In claims the arriving document is the trigger (first notice of loss, a repair schedule, an invoice), so document arrival is the domain's native event. The input is heterogeneous rather than a single feed: "policies, photos, invoices, handwriting", with fourteen documents on one worked claim.

Continuity is first-party and explicit, though it sits on the older security page rather than the rebuilt home page: "24/7 workflow continuity", to "run critical processes nonstop, even outside business hours." Real-time fraud signals are monitored, and updates go out consistently across customer channels.

Channel coverage is real but narrow: documents in several formats including handwriting and photographs, plus a customer-support agent with its own page implying an inbound service channel. No named scheduler, subscription model or queue interface is documented, and while webhook support has been stated, no current page names a webhook.

Sourcemarvelx.ai home solution pipeline step 01, marvelx.ai/security 24/7 workflow continuity tileread 2026-09-14

MarvelX runs its own domain-specific models and names no provider or customer choice of model. It uses its own models trained on insurance data with reinforcement learning and generative AI. The older security page sells "domain-specific models" with "lightning-fast accuracy, customized to the unique needs of your business", and the rebuilt home page captions its expert gate "Your rules" and "not a model". A product positioned on proprietary vertical models and customer-authored rules has no commercial reason to expose a model selector, and does not.

No provider is named anywhere, and no selector, disclosed routing or bring your own key path is published. What the customer does control is the training data and the rules, not the engine: a published customer account describes an agent "customized to our specific products, trained on our own data", and step five drills it in the Agent Gym.

Training a vendor's model on your data is not selecting which model runs. AWS, GCP and Azure named on the trust center are infrastructure providers, not a second model. No negative statement is published either; the site is silent and the positioning points away from model choice.

Sourcemarvelx.ai home solution pipeline step 04 and customer account, marvelx.ai/security domain-specific models tile, trust.marvelx.ai AI and operational security sectionsread 2026-09-14

Integrations is a governed platform component, but nothing on the site shows the platform being callable from outside. It has its own page in the platform navigation, and the trust center lists Integrations under Product Security, so it is governed as part of the product. A named, governed integrations component plus a documented two-way flow with the customer's systems is a real extension surface. The product is described elsewhere as integrating through robust APIs and webhook support, but no page on the current site names an API, an SDK or a webhook, so that claim is unconfirmed.

What is missing is a documented API or SDK through which an external system or another vendor's agent drives MarvelX. There is no developer entry in the navigation, no documentation host, no SDK, no MCP server and no published reference. The direction that is documented runs the other way, MarvelX reaching into the insurer's systems to collect documents and deliver outputs.

Sourcemarvelx.ai platform navigation read across two pages, trust.marvelx.ai product security sectionread 2026-09-14

A changed agent is drilled in a named harness, the Agent Gym, before it goes live. Agent Gym is listed first among the platform pages, with a durable URL. Step five of the published pipeline reads "AI self-improves. Drilled in the Agent Gym before it goes live." A training and testing stage standing between a changed agent and production is a pre-deployment harness in the strict sense, and it puts a change under test.

The governance side supports it: the trust center publishes an AI system development and evaluation policy among its policies and lists AIUC-1, an AI-specific certification, among its compliance items.

What is drilled is the vendor's own claims agent on this customer's products and data, "customized to our specific products, trained on our own data" per the published customer account. Customer subject matter experts also take part in training and refining agents, and assessment accuracy is measured.

What is known of the harness is its name and the before it goes live promise; no scored cases, golden set or published accuracy measure is described.

Sourcemarvelx.ai home solution pipeline step 05 and platform navigation, trust.marvelx.ai policies and compliance sectionsread 2026-09-14

There is no screen in the loop: the agents work on documents and write results back into the insurer's system through integrations and APIs. No hosted or local browser, desktop session or remote computer control is documented. The action path is documents in and a write into the customer's system out, with "upload them, or we collect them straight from your systems" at one end and "once the output is delivered to your system" at the other.

Document AI is the vendor's headline capability and can read like visual automation: "our AI agents handle everything from extracting data in messy handwritten docs to drafting settlement reports", and the pipeline reads "policies, photos, invoices, handwriting. Every field scored." Reading a photograph of a damaged vehicle or a handwritten claim form is perception applied to a file, not an agent operating an interface.

Breakage when UI elements change has no meaning against PDFs, photographs and a system write back; the vendor's failure mode is a document it cannot parse rather than a layout it cannot find. Insurance claims platforms are the kind of legacy estate other products drive by screen automation, and this vendor connects to them through an Integrations component instead. The architecture is described in enough detail that an undocumented screen-driving path is implausible.

Sourcemarvelx.ai home hero and solution pipeline, platform and solutions navigationread 2026-09-14