Security
Built for a procurement review, not just a trust badge
Property and policy data is sensitive. Here is exactly how it is stored, who can reach it, who processes it on our behalf, and how long we keep it.
Encryption everywhere
Data is encrypted in transit via TLS and at rest with AES-256. Customer-supplied credentials — AI keys and CRM connector tokens — are separately envelope-encrypted (AES-256-GCM) and are decrypted only server-side at call time. They are never returned by any API, only a redacted prefix.
Infrastructure
Hosted on Vercel and Supabase, both of which hold SOC 2 Type II certification. Automatic scaling, DDoS protection, and high-availability infrastructure — live uptime is published on our status page.
Access controls
Role-based access with row-level security enforced in the database, plus OAuth 2.0 authentication. Tables holding proprietary or paid data are service-role only — denied to browser clients outright rather than filtered. Staff access to a customer account is logged to a tamper-evident audit trail.
Auditability
Legally weighted actions — consent, quote requests, configuration and PII-deletion events — are written to a hash-chained audit ledger where each entry commits to the one before it, so an edit or deletion is detectable rather than silent.
Deletion & retention
You can delete your account from Account settings. Deletion takes effect immediately: it cascades across the data graph, anonymizes activity history rather than orphaning it, and is recorded as a durable compliance record, with any residual cleanup completed within 30 days.
Compliance
We are building toward SOC 2 Type II certification and are not yet certified in our own right. Our data-handling practices align with CCPA and industry practice for PII protection.
Sub-processors
Third parties that process data on our behalf, and what each one is used for.
- Vercel
- Application hosting and CDN, and privacy-preserving web analytics
- Supabase
- Database, authentication, and file storage
- Anthropic
- CoverGuard Advisor and agent inference
- Stripe
- Subscription billing and payments
- Resend
- Transactional email delivery
- Upstash
- Rate limiting and distributed caching
- Sentry
- Error and performance monitoring
- Google Maps Platform
- Geocoding, imagery, and place data
- ATTOM Data Solutions
- Property records for the addresses you search
- RentCast
- Property details and valuation data for the addresses you search
- Walk Score
- Walkability and transit scores for the addresses you search
- Segment (Twilio)
- Product analytics — not loaded when your browser sends Global Privacy Control
- Slack
- Internal notification of demo and early-access requests
- Cloudflare Turnstile
- Bot protection on public forms
Data retention
How long each class of data is kept before an automated sweep removes or anonymizes it. Read the full rules in the privacy policy.
- Product analytics events
- 30 days
- Request and API telemetry
- 90 days
- IP addresses on telemetry
- Anonymized at 90 days
- Email delivery logs
- 90 days
- Account activity history
- 365 days (deleted or anonymized)
- Feedback on property Records
- 24 months after your last change
- Quote requests
- Up to 7 years (insurance record-keeping)
Application data is processed and stored in the United States.
Running a security review?
Send us your questionnaire and we will complete it. For a vulnerability report, email the security team directly — we respond to every report.