Coverly Security & Compliance — SOC 2, HIPAA-aligned, encrypted

01 — Data Protection

Encryption everywhere, by default

All data at rest is encrypted using AES-256 via Neon PostgreSQL. All data in transit is protected by TLS 1.2 or higher. Secrets such as API keys and database credentials are stored exclusively in environment variables — never in code, configuration files, or version control.

PHI and PII are never written to application logs. Structured logs capture event types, timestamps, and aggregate metrics only. Log retention is 90 days; raw payloads are excluded.

Database credentials are rotated on a 90-day schedule and are scoped to the minimum permissions required by the application — the Coverly process has no administrative access to the underlying host.

02 — Access Controls

Least privilege, no exceptions

Admin access to production systems is restricted to a small number of named operators and is enforced via session-based authentication on the /admin dashboard. Direct database access is limited to migration and deployment workflows, never via a persistent admin role.

Every contact interaction — quote requested, carrier selected, followup dispatched — is logged in the contact_events table with a timestamp, actor, and event type. Audit logs are retained for 12 months and are available for enterprise customers on request.

Production environment variables are managed at the platform level and are not exposed to the application codebase at runtime. Access to platform-level configuration is restricted to the operations team and reviewed quarterly.

03 — Compliance Posture

Active path to certification

Coverly maintains an active compliance program aligned with standards relevant to insurance sales automation. The current status of key frameworks:

In Progress

SOC 2 Type II

Target attestation Q4 2025. Controls mapped to the Security and Confidentiality trust service criteria.

HIPAA-Aligned

HIPAA

BAA available on Enterprise tier. Data handling scoped to insurance lead processing — no treatment data.

Aware

GLBA

Financial privacy obligations reviewed annually. No consumer financial data retained beyond operational need.

Aware

State DOI

Carrier appointment and appointment reporting framework understood. Product operates under existing broker/carrier licenses.

04 — Subprocessors

Third-party services and data residency

Coverly uses a minimal set of third-party services. No subprocessors receive PII or PHI unless explicitly noted. All subprocessors are US-hosted.

Service	Purpose	Data shared	Region
Render Infrastructure	Application hosting and compute	Application code and runtime data	US-East
Neon (PostgreSQL) Database	Relational data store for CRM and lead records	Contact records, quote data, followup sequences	US-East
OpenAI LLM Inference	AI lead qualification and scoring	Lead attributes only — no PII or PHI transmitted	US
Postmark Transactional Email	Nurture sequence and confirmation emails	Recipient email address and content — no PII beyond email	US
Stripe Payments	Billing on Carrier and Enterprise tiers	Payment method and billing details — no contact data	US

05 — Incident Response

24-hour notification SLA on Enterprise

Coverly maintains a documented incident response procedure. When a confirmed security event occurs affecting customer data, Enterprise tier customers are notified within 24 hours of confirmation.

1

Detection and triage

Anomalous activity or alert triggers internal review. Severity is classified within 2 hours of detection.

2

Containment

Affected systems are isolated and the attack surface is reduced. Root cause identification begins in parallel.

3

Notification

Enterprise customers are notified via the registered security contact within 24 hours of confirmed incident. Carrier and Broker customers notified within 72 hours.

4

Post-mortem

A written post-mortem is prepared within 14 days and shared with affected Enterprise customers. Remediation steps are tracked to completion.

A status page at status.coverly.ai reflects current service health and any active incidents.

06 — Uptime & Reliability

99.9% SLA on Enterprise

Coverly maintains a public health endpoint at /health returning real-time application status. The endpoint is polled by our infrastructure monitor and reflects the true state of the service — not a static "healthy" response.

Enterprise customers receive a service level agreement specifying 99.9% monthly uptime, measured as the percentage of 24-hour periods in which the application is responsive. SLA credits apply for any period below that threshold, subject to the Enterprise agreement terms.

Carrier and Broker tier services are best-effort. Scheduled maintenance is announced at least 72 hours in advance via the registered contact email.

07 — Data Retention & Deletion

You own your data — full stop

Coverly retains contact records and interaction data for operational purposes. Retention periods and deletion policies:

Data type	Retention	Deletion
Contact records (leads, quotes)	Until account closure or 24 months of inactivity	Deleted within 30 days of written request or account closure
Contact event logs	12 months	Purged automatically at 12-month boundary
Followup sequences	Tied to contact record	Deleted with associated contact record
Partner / broker data	Duration of active agreement	Deleted within 30 days of agreement termination

Export: A CSV export of all contact records is available on request from the partner dashboard or by contacting security@coverly.ai. Exports are delivered within 5 business days.

Coverly is built for regulated insurance workloads