Trust Center
Built for regulated, money-bearing workflows
CoverGuard influences purchase and lending decisions, so security, privacy, accessibility, and auditability are design requirements — not afterthoughts. Here is exactly where we stand.
Encryption everywhere
TLS in transit and AES-256 at rest, backups included. Customer-supplied credentials, such as AI keys and CRM tokens, are encrypted again and decrypted only on the server.
Infrastructure
Hosted on Vercel and Supabase, both of which hold SOC 2 Type II certification, with DDoS protection and autoscaling.
Access controls
Role-based access, Postgres row-level security, OAuth 2.0, and least-privilege across systems.
Accessibility
WCAG 2.2 AA is the design floor. Our accessibility statement lists what we support, the gaps we know about and how to report a barrier. An Accessibility Conformance Report (VPAT/ACR) is planned.
How the CoverGuard Advisor is governed
The Advisor is AI woven through the product — but it is a bounded capability, not the system of record. It reads the same auditable outputs you can, explains them, and recommends next steps. The deterministic engine decides; the model never does.
- Explain any hazard, score, or modeled carrier view in plain language
- Compare the modeled carriers, plan remediation, and draft client-ready copy
- Synthesize across a property, deal, or portfolio
- Show which CoverGuard data each answer read
- Set or finalize a price, or make the insurability decision of record
- Bind coverage or commit money
- Give legal, tax, or accounting advice
- Access another tenant's data or override access controls
Compliance documents
The candid status of each document. If your review needs one that is still planned, email the security team and we will tell you where it stands.
| Document | Status | Notes |
|---|---|---|
| SOC 2 | Not yet certified | We are not SOC 2 certified in our own right. The audit scope and a readiness plan come first. Our hosting providers hold their own SOC 2 Type II certification. |
| VPAT / ACR (WCAG 2.2 AA) | Planned | The Accessibility Conformance Report will be written once our WCAG 2.2 AA remediation work lands. |
| Accessibility statement | Published | What we support today, the limitations we know about, and how to report a barrier. Read the statement |
| Data Processing Addendum (DPA) | Planned | A CCPA-aligned DPA for enterprise agreements is planned. Ask the security team where it stands. |
| Sub-processor list | Published | Every third party that processes data on our behalf, and what each one is used for. See the list |
| Penetration test | Planned | A third-party penetration test is still to be scheduled. There is no report to share yet. |
Running a security or procurement review?
Encryption, access controls, sub-processors, data residency and retention schedules are on the Security page. For a completed questionnaire, or the status of a document above, email the security team.
Asking how the numbers themselves are derived? How this is modeled covers what is measured, what is modeled and what a modeled estimate is not.
From the CoverGuard Record to a quote request — without the surprises
With carriers exiting major markets, insurance is killing deals at closing. CoverGuard reads the CoverGuard Record, models which carriers are likely to write the risk and what cover should cost, and sends your quote request to CoverGuard’s brokerage team — before anyone signs on the dotted line.
CoverGuard is in Private Preview. Ask for an invitation and a member of our team will review it — usually within one business day. Available in all 50 states.