Security & Trust

Built So Client Data Doesn't Stick Around

SurePortal's security model is simple: encrypt everything, keep it only as long as the job requires, then destroy it permanently. Here is exactly how that works.

Zero-Retention Lifecycle

From Secure Link to Permanent Deletion

Client data follows a one-way path with deletion built in at every stage.

PIN-Protected Link

Every secure link requires a 4-8 digit PIN (stored only as a bcrypt hash) and expires after a configurable 30-60 minute window.

Encrypted Submission

Each sensitive field is individually encrypted with AES-256-GCM before it is stored. The encryption keys live outside the database, in separate infrastructure.

View Once

The broker reviews the submission a single time. The moment it is viewed, the encrypted data is permanently purged.

Automatic Purge

Submissions never viewed are automatically destroyed within 7 days. An automated purge job runs every 5 minutes to expire links on schedule.

Controls

The Controls Behind the Promise

Field-Level Encryption

AES-256-GCM applied per field with key rotation support. Keys are held outside the database, so database access alone cannot decrypt client PII. TLS 1.2+ protects all data in transit.

Account Security

Broker accounts support TOTP two-factor authentication with a verified, email-confirmed recovery flow. Passwords require 12+ characters and are screened against known breach corpuses.

Access Isolation

Row-level security enforces tenant isolation at the database layer, and server roles follow least privilege. One broker can never query another's data.

Metadata-Only Audit Trail

Every lifecycle event—link created, opened, submitted, viewed, purged—is recorded in an append-only audit log that contains no client PII.

Continuous Security Testing

A structured, OWASP-aligned internal assessment program with automated regression tests for authorization and encryption. All 20 findings from our 2026 assessment cycles are closed—remediated and verified, or formally risk-accepted and documented.

No Secondary Use

Client data is never sold, never shared with third parties for their own purposes, and never used to train AI models. It exists to reach you, once.

Compliance

Built for Regulated Workflows

SurePortal is designed to support the Gramm-Leach-Bliley Act (GLBA) Safeguards obligations that apply to insurance professionals: encryption at rest and in transit, access controls, retention limits, and audit logging. More than 25 states have also enacted insurance data-security laws based on the NAIC Insurance Data Security Model Law (#668), which apply to agents and agencies directly as licensees—including security-program and breach-notification duties. SurePortal's zero-retention design supports both. Our security documentation is maintained in alignment with SOC 2 Trust Services Criteria, and formal certification is on our roadmap.

Subprocessors

Where Data Is Processed

SurePortal uses a deliberately small set of infrastructure providers—Vercel, Supabase, Stripe, Resend, and Sentry, all in the United States—and no client PII is shared with any of them beyond what is required to operate the service. Secure links reach your clients from your own device (your phone's messages or your email app), so no provider ever receives your client's phone number or email address. The maintained list, with each provider's purpose, location, and exact data exposure, is on our subprocessors page.

Reviewing SurePortal for Your Organization?

IMOs, BGAs, and agencies can request our security documentation package under NDA—encryption specification, assessment summaries, data-handling policies, and architecture diagrams. Security researchers: report vulnerabilities to security@surehelp.app and we will respond promptly.