Security at Insurstein

All sensitive data encrypted at rest with AES-256-GCM using random initialization vectors. Documents, audio recordings, OAuth tokens, and SMTP credentials are encrypted before database storage. TLS 1.2+ enforced on all connections.

Four roles (Admin, Producer, CSR, Viewer) with page-level and field-level access controls. Per-user permission overrides for granular access. 225+ auth checks across the codebase.

Every database query is scoped by agency ID derived from the authenticated session. Agency A cannot access Agency B's data at any layer. Twilio phone system uses per-agency subaccounts for call and SMS isolation.

Engineering practices follow SOC 2 Trust Services Criteria (CC6 Access Controls, CC7 System Operations, CC8 Change Management, CC9 Risk Mitigation). Controls are documented and maintained alongside the codebase.

Every data change, login, permission check, and sensitive action is logged with timestamps, user IDs, and before/after state. Audit logs are retained for a minimum of 6 years per HIPAA-aligned retention policy.

68+ security events logged with machine-parseable JSON: authentication failures, rate limit hits, IDOR attempts, webhook signature rejections, account lockouts, and session invalidations.

Password policy: 8-72 characters with complexity requirements. HIBP breach database checking. Account lockout after 5 failed attempts (15-minute sliding window). MFA support via TOTP.

Hosted on Vercel (SOC 2) with Supabase PostgreSQL (SOC 2). HSTS with 2-year max-age and preload. Content Security Policy headers. X-Frame-Options, X-Content-Type-Options, and Referrer-Policy enforced on every response.