Security

Insurso stores sensitive insurance data — client records, policies, claims, and commissions. We take that responsibility seriously. This page summarizes the safeguards built into the Service.

Tenant isolation

Every record is scoped to an agency. Data access is enforced at the database layer with PostgreSQL Row-Level Security, so one agency can never read or write another agency's data — even if application code has a bug. Each request is resolved to the signed-in producer's agency before any data is returned.

Authentication

• Authentication is handled by a dedicated identity provider (Clerk); we never store your password.
• Role-based access separates agency owners, producers, and customer-service reps (CSRs).
• Session tokens are validated on every protected route via middleware.

Encryption

• All traffic is encrypted in transit with TLS.
• Data is encrypted at rest by our infrastructure providers.
• Especially sensitive fields (such as EIN and date of birth) are flagged for column-level encryption via the database vault before production use.

Immutable audit trail

Coverage interactions, certificate issuance, and commission entries are written to append-only logs. These records cannot be edited or deleted from the application, giving your agency a defensible E&O audit trail.

Payments

Billing is processed by Stripe. Insurso never sees or stores full card numbers; card data is handled directly by Stripe's PCI-DSS-compliant infrastructure.

Reporting a vulnerability

If you believe you've found a security issue, please email security@insurso.com. We appreciate responsible disclosure and will respond promptly.

This page describes our security practices at a high level and does not form part of any contract or warranty.