Security at PolicyVera

Last reviewed: August 2026

PolicyVera moves insurance and closing information between borrowers, lenders, and licensed local agents. Protecting that information is part of the product. This page describes our safeguards in plain terms, and every statement on it is kept current against the running system.

How we protect your information

Encrypted everywhere

Traffic is encrypted in transit with TLS, with policyvera.com HSTS preloaded in major browsers, and data is stored with encryption at rest. Sensitive identifiers carry an additional AES-256-GCM encryption layer at the application level.

Only what is needed

PolicyVera stores the last four digits of a Social Security number, never the full number. Loan-file imports read a strict whitelist of fields, and automated tests lock that whitelist so SSN, income, and asset values are never read from loan documents.

Least privilege by default

Access is role based and sensitive actions are audit logged. Administrator access requires two-factor authentication, with support for passkeys and hardware keys, and administrative step-up expires every four hours.

Our security program

  • Dependency monitoring runs continuously, and automated vulnerability audits and full-history secret scans run on a recurring schedule with a dated pass and fail record.
  • Security reports are acknowledged and triaged within 72 hours. Response timeframes are objectives calibrated to published industry practice, not guarantees.
  • A designated security lead owns the program under the FTC Safeguards Rule (16 CFR 314), and the program is reviewed at least semiannually.
  • Live service status is published independently of our application infrastructure at status.policyvera.com.

Infrastructure

PolicyVera runs on SOC 2 attested infrastructure providers: Vercel, Supabase, and Cloudflare. Application data is hosted in the United States. Network, host, and database-infrastructure security is inherited from those providers, and PolicyVera directly manages application code, dependencies, and platform configuration.

PolicyVera does not currently hold a SOC 2 attestation of its own. Our program is designed on the FTC Safeguards Rule and recognized security practice, and we answer lender and partner security questionnaires on request.

Report a security issue

Email security@policyvera.com with steps to reproduce. Reports are acknowledged and triaged within 72 hours. Please do not open public issues for suspected vulnerabilities. We do not offer a bug bounty program at this time. Machine-readable details are published at /.well-known/security.txt.

Related

Privacy Policy · Privacy Choices · Terms of Service