Security
Everything is encrypted.
Built in from day one.
“How do I know my data is safe?” It's the first question people ask us. Todd answers it in two minutes: AES-256 encryption, a unique key per account, verified access, isolated data, and independent audits.
What stands behind your data
AES-256 encryptionIn transit · at rest
Unique key per accountYour key opens only your data
Verified accessIdentity confirmed every time
Data isolationEnforced by the database
SOC 2 Type IIIndependently audited
ISO 27001Certified standard
How your data is protected
Five layers. Each one verifiable.
- 01
Encryption
Everything is encrypted.
Every file, call recording, document, and transcript. While it moves and while it sits.
- Encrypted in transitFrom your phone or computer to our servers, your data travels encrypted. Nothing crosses the wire in the clear.
- Encrypted at restIt stays encrypted in storage. It is only decrypted when you request access, and we have verified it is actually you.
- AES-256The same standard widely used by banks, government agencies, and major tech companies.
- A unique key for every accountEven someone who somehow reached the storage itself would see unreadable data. Without your key there is no access, and your key cannot unlock anyone else’s information.
- 02
Access control
Identity is verified. Every time.
Access isn’t granted once and remembered. It is checked on every request.
- Verified on every accessEach time data is accessed, we verify who is asking before anything is decrypted.
- Passwords are never stored readableYour password lives only as a one-way mathematical hash. Even our own team cannot simply look it up.
- 03
Isolation
Your data is isolated from every other customer’s.
Separation isn’t left to the application alone.
- Isolated by accountYour information is kept apart from every other customer’s, by design, not by policy.
- Enforced by the database itselfThe database enforces which account can access which information. An independent layer beneath the application.
- 04
Sharing
No public links. Ever.
Sharing a document or a call recording never means exposing it.
- Secure, time-limited linksA shared document link is tied to that one document and expires. Once it expires, it no longer works.
- Call recordings, the same wayNothing floats around publicly. You request access, we verify the request, and then you can view it.
- 05
Independent verification
Don’t take our word for it.
The infrastructure behind it is reviewed by independent auditors against recognized standards.
- SOC 2 Type IIIndependent auditors review how data is protected over a sustained period, not a single snapshot, across security, availability, processing integrity, confidentiality, and privacy.
- ISO 27001The internationally recognized standard for information security management: access control, risk management, incident response, and ongoing monitoring.
The executive summary
Five things to remember.
- 01Your data is encrypted.
- 02Your account has its own unique key.
- 03Access is verified.
- 04Your information is isolated from other customers.
- 05The infrastructure is backed by recognized standards.
Built in from day one.
Not as an afterthought.
Your homeowners hand the team inside your app the most personal parts of owning a home: insurance policies, closing documents, bills, and their conversations with Nora. Every one of them lives inside the security model above, under your brand.
Questions?
Have security questions? Let's talk.
If you ever have a question about how your data is protected, reach out. Todd is happy to answer it personally.