Security
Built for a procurement review, not just a trust badge
Property and policy data is sensitive. Here is exactly how it is stored, who can reach it, who processes it on our behalf, and how long we keep it.
Encryption everywhere
Data is encrypted in transit via TLS and at rest with AES-256. Customer-supplied credentials — AI keys and CRM connector tokens — are separately envelope-encrypted (AES-256-GCM) and are decrypted only server-side at call time. They are never returned by any API, only a redacted prefix.
Infrastructure
Hosted on Vercel and Supabase, both of which hold SOC 2 Type II certification. Automatic scaling, DDoS protection, and high-availability infrastructure — live uptime is published on our status page.
Access controls
Role-based access with row-level security enforced in the database, plus OAuth 2.0 authentication. Tables holding proprietary or paid data are service-role only — denied to browser clients outright rather than filtered. Staff access to a customer account is logged to a tamper-evident audit trail.
Auditability
Legally weighted actions — consent, quote requests, binds, configuration and PII-deletion events — are written to a hash-chained audit ledger where each entry commits to the one before it, so an edit or deletion is detectable rather than silent.
Deletion & retention
You can delete your account from Account settings. Deletion cascades across the data graph, anonymizes activity history rather than orphaning it, and is recorded as a durable compliance record fulfilled within a 30-day SLA.
Compliance
We are building toward SOC 2 Type II certification and are not yet certified in our own right. Our data-handling practices align with CCPA and industry practice for PII protection.
Sub-processors
Third parties that process data on our behalf, and what each one is used for.
- Vercel
- Application hosting and CDN
- Supabase
- Database, authentication, and file storage
- Anthropic
- CoverGuard Advisor and agent inference
- Stripe
- Subscription billing and payments
- Resend
- Transactional email delivery
- Upstash
- Rate limiting and distributed caching
- Sentry
- Error and performance monitoring
- Google Maps Platform
- Geocoding, imagery, and place data
Data retention
How long each class of data is kept before an automated sweep removes or anonymizes it.
- Product analytics events
- 30 days
- Request and API telemetry
- 90 days
- IP addresses on telemetry
- Anonymized at 90 days
- Email delivery logs
- 90 days
- Account activity history
- 365 days
- Quote requests
- Up to 7 years (insurance record-keeping)
Application data is processed and stored in the United States.
Running a security review?
Send us your questionnaire and we will complete it. For a vulnerability report, email the security team directly — we respond to every report.