Designed for the trust your clients place in you.
Private documents, controlled access and people in charge of coverage decisions.
Controls built into the connected workspace
Private client documents
Policy files belong in your private workspace. The server checks access to the request before allowing document access; files are not published with your brokerage website.
The right access for each role
Separate permissions support brokerage administrators, licensed staff, support staff, customers and wholesaler teams. Organization membership and request permissions are checked on the server.
Protected account sessions
Staff identity is verified through Supabase Authentication. Authenticator setup and sign-in checks are available, and administrators can require MFA for their organization. Account cookies use Secure, HttpOnly and SameSite protections. Write requests must come from the approved application origin.
AI prepares. Authorized people decide.
Extracted information is proposed for review. Your team resolves missing details and checks draft applications. The platform does not independently bind coverage, issue policies or guarantee carrier acceptance.
Records of important changes
Organization changes, security policies, authenticator actions, incident records, page publishing and supported request actions create activity records. Use these to review who changed what. These records are not an independently certified or immutable audit archive.
Controlled public intake
Published forms require consent and apply request limits. Forms placed inside another website use an exact website allowlist. Agent pages require active membership and verified licensing information.
Match the setup to your brokerage
Security is an ongoing operational responsibility. Agree on processes, configuration and verification before rollout.
Account protection
Enroll your authenticator, verify it, then enable your organization’s MFA requirement. Staff can revoke other workspace sessions. Confirm recovery and offboarding procedures. Enterprise SSO needs separate implementation and validation.
Data handling & agreements
Set a retention review period, record holds and identify an incident owner in Security & operations. Agree on permitted client data, processing providers, confidentiality terms and approved deletion procedures. Client records are not automatically purged. Do not send sensitive client files to the public demo inquiry form.
Recovery & incident response
Use the incident register and record dated rollout evidence. Confirm production database and document backups, test isolated recovery and agree on monitoring and response expectations. Published recovery guarantees and round-the-clock security operations are not currently offered.
Your brokerage’s requirements
Review your applicable obligations and carrier or wholesaler requirements with your compliance team. SOC 2, ISO 27001 and HIPAA certification or compliance are not claimed. This product overview is not a compliance attestation.
Discuss your security requirements · Website & account privacy notice
