Coverly Security & Compliance

All data at rest is encrypted using AES-256 via Neon PostgreSQL. All data in transit is protected by TLS 1.2 or higher. Secrets such as API keys and database credentials are stored exclusively in environment variables — never in code, configuration files, or version control.

PHI and PII are never written to application logs. Structured logs capture event types, timestamps, and aggregate metrics only. Log retention is 90 days; raw payloads are excluded.

Database credentials are rotated on a 90-day schedule and are scoped to the minimum permissions required by the application — the Coverly process has no administrative access to the underlying host.

Coverly maintains an active compliance program aligned with standards relevant to insurance sales automation. The current status of key frameworks:

Every webhook Coverly sends is signed using HMAC-SHA256 over ${timestamp}.${body} — the Stripe convention. Receivers verify the signature with a per-endpoint secret minted at endpoint creation and rotated on demand from the partner dashboard. Replay attacks are mitigated by a 5-minute timestamp tolerance window enforced server-side.

Two HTTP headers are sent on every delivery:

• Coverly-Event — the event type, e.g. lead.created
• Coverly-Signature — t=<unix-seconds>,v1=<hex-hmac-sha256>

Partner integration uses long-lived API keys with the prefix ck_live_ (256-bit entropy). Keys are sha256-hashed at rest; the plaintext is shown once at generation and never re-displayed. Rotation is self-serve — revoke and reissue from /for-brokers/api-keys; revoked keys are blocked instantly. API keys support instant rotation — generate a new key, copy it into your secrets store, then revoke the old one. Revoked keys are blocked at the edge immediately.

Coverly uses a minimal set of third-party services. No subprocessors receive PII or PHI unless explicitly noted. All subprocessors are US-hosted.

Coverly maintains a documented incident response procedure. When a confirmed security event occurs affecting customer data, Enterprise tier customers are notified within 24 hours of confirmation.

Coverly maintains a public health endpoint at /health returning real-time application status. The endpoint is polled by our infrastructure monitor and reflects the true state of the service — not a static "healthy" response.

Enterprise customers receive a service level agreement specifying 99.9% monthly uptime, measured as the percentage of 24-hour periods in which the application is responsive. SLA credits apply for any period below that threshold, subject to the Enterprise agreement terms.

Carrier and Broker tier services are best-effort. Scheduled maintenance is announced at least 72 hours in advance via the registered contact email.

Coverly operates in the health insurance space and is HIPAA-aligned by design. We collect the minimum data required to qualify a health-lead and route it to a licensed broker. Specifically:

• BAA available on Enterprise — every Enterprise-tier health-insurance deployment is signed under a Business Associate Agreement before launch.
• No treatment data — diagnoses, claims, Rx history, lab results, or any clinical notes are never processed by Coverly. Consent for data collection is collected at intake.
• No payment data — banking, ACH, or card numbers never pass through Coverly systems. Premium billing remains with the carrier or licensed broker.
• Minimum necessary — uploaded documents are filtered to fields the broker actually needs (ZIP, household size, ages, AGI band). Excess fields are discarded before storage.
• Inference privacy — LLM-based qualification receives lead attributes only. PII and PHI fields are stripped before any call to the AI model.

Audit logs and data export are available on request through your BAA-covered account manager, or by emailing security@coverly.com.

Coverly retains contact records and interaction data for operational purposes. Retention periods and deletion policies:

Export: A CSV export of all contact records is available on request from the partner dashboard or by contacting security@coverly.com. Exports are delivered within 5 business days.