Last reviewed: August 2026
PolicyVera moves insurance and closing information between borrowers, lenders, and licensed local agents. Protecting that information is part of the product. This page describes our safeguards in plain terms, and every statement on it is kept current against the running system.
Traffic is encrypted in transit with TLS, with policyvera.com HSTS preloaded in major browsers, and data is stored with encryption at rest. Sensitive identifiers carry an additional AES-256-GCM encryption layer at the application level.
PolicyVera stores the last four digits of a Social Security number, never the full number. Loan-file imports read a strict whitelist of fields, and automated tests lock that whitelist so SSN, income, and asset values are never read from loan documents.
Access is role based and sensitive actions are audit logged. Administrator access requires two-factor authentication, with support for passkeys and hardware keys, and administrative step-up expires every four hours.
PolicyVera runs on SOC 2 attested infrastructure providers: Vercel, Supabase, and Cloudflare. Application data is hosted in the United States. Network, host, and database-infrastructure security is inherited from those providers, and PolicyVera directly manages application code, dependencies, and platform configuration.
PolicyVera does not currently hold a SOC 2 attestation of its own. Our program is designed on the FTC Safeguards Rule and recognized security practice, and we answer lender and partner security questionnaires on request.
Email security@policyvera.com with steps to reproduce. Reports are acknowledged and triaged within 72 hours. Please do not open public issues for suspected vulnerabilities. We do not offer a bug bounty program at this time. Machine-readable details are published at /.well-known/security.txt.