Built for E&O exposure.
Engineered for your audit.

TLS 1.2+ in transit with TLS 1.3 negotiated. AES-256 at rest. All customer data, always. Key rotation is managed by Koffyr — never your problem.

Row-level isolation in the database. S3 prefix isolation for documents. Cross-tenant access is prevented by multiple independent controls — row-level policy enforcement, service-layer scoping, and independently validated authorization sweeps.

Every action stamped + tamper-evident. One-click E&O export on every plan. Your carrier will thank you.

ESIGN Act and UETA compliant — built in, not bolted on. No DocuSign middleware, no envelope fees, no “is this signature good enough?” guesswork. Aligned with eIDAS Advanced Electronic Signature (AdES) standards for future EU use.

SOC 2 Type I targeted for Q4 2026. Security policies are drafted and our control program is being built — current security questionnaire responses are available under NDA on request.

All customer data stored in US AWS regions. No transfers without explicit notice and your consent.

Sensitive fields (Tax ID / EIN, email, phone, date of birth, home address) encrypted at the application layer above database encryption — with keys held outside the application database. Consistent with DPA Schedule 2.

Continuous backups with point-in-time recovery, plus immutable weekly recovery points retained 35 days. Documented restore runbook in place; first full restore drill scheduled Q4 2026.

Passkeys (WebAuthn) are the primary authentication mechanism — phishing-resistant and strong by design. Email magic links provide a single-factor possession alternative. No passwords are stored. Session tokens carry a short TTL.

Third-party penetration test planned for Q4 2026, alongside SOC 2 Type I readiness. Incident response plan in place; full tabletop exercise scheduled before launch.