Security

Insurso stores sensitive insurance data — client records, policies, claims, and commissions. We take that responsibility seriously. This page summarizes the safeguards built into the Service.

Tenant isolation

Every record is scoped to an agency. Data access is enforced at the database layer with PostgreSQL Row-Level Security, so one agency can never read or write another agency's data — even if application code has a bug. Each request is resolved to the signed-in producer's agency before any data is returned.

Authentication

• Authentication is handled by a dedicated identity provider (Clerk); we never store your password.
• Role-based access separates agency owners, producers, and customer-service reps (CSRs).
• Session tokens are validated in each protected route handler via the Clerk SDK.

Encryption

• All traffic is encrypted in transit with TLS.
• Data is encrypted at rest by our infrastructure providers.
• Column-level encryption for especially sensitive fields is planned.

Immutable audit trail

Coverage interactions, certificate issuance, and commission entries are written to append-only logs. These records cannot be edited or deleted from the application, giving your agency a defensible E&O audit trail.

Payments

Billing is processed by Stripe. Insurso never sees or stores full card numbers; card data is handled directly by Stripe's PCI-DSS-compliant infrastructure.

Reporting a vulnerability

If you believe you've found a security issue, please email security@insurso.com. We appreciate responsible disclosure and will respond promptly.

This page describes our security practices at a high level and does not form part of any contract or warranty.