Security at QuoteSweep

Carrier credential management

Credentials are never stored in our application database. Every carrier credential is kept in AWS Secrets Manager — Amazon’s dedicated vault used by banks, hospitals, and government agencies — and encrypted with AWS Key Management Service (KMS) before it is saved. KMS provides hardware-backed key protection, and QuoteSweep never has access to plaintext credentials in our application database.

Credentials are never sent to AI models. Carrier usernames, passwords, and carrier-portal MFA seeds (TOTP) are never included in any prompt or context sent to an AI provider. The AI agent receives only the business data needed to complete the quote form; credentials reach the AI web agent only through a dedicated secret-injection channel and are entered directly into the carrier portal, never as part of the model’s prompt or reasoning.

You stay in control. Credentials can be rotated or deleted at any time from the QuoteSweep dashboard, and all stored credentials are destroyed when the agency relationship ends.

Client data protection

Agency data isolation. Tenant isolation is enforced in the application data-access layer, where every database query is scoped by agency ID. A dedicated automated cross-tenant test suite runs on every deployment to verify that no user from one agency can access, view, or modify records belonging to another — even when two agencies quote the same carrier.

Encryption in transit. All connections between your team’s browser and QuoteSweep are encrypted using TLS 1.2 or higher, and HTTP Strict Transport Security (HSTS) is enabled to prevent protocol-downgrade attacks.

Encryption at rest. Application data is stored in managed database services that provide encryption at rest using AES-256, and backups are encrypted to the same standard.

Data retention. Applicant data is retained for the active life of the agency relationship plus the period required by state insurance regulations. Agencies can request deletion of specific records via support, and on offboarding, applicant data and credentials are destroyed within 30 days.

AI providers used during quoting

When QuoteSweep runs a quote, an AI web agent fills out the carrier portal on your behalf. To do that, applicant business data is processed by two kinds of provider:

• • AI web agent provider (Browser Use). Drives the carrier-portal session and receives the applicant data needed to complete the quote form. That data is present in the provider’s environment only for the duration of the session. We select providers that offer session-level data isolation and limited data retention.
• • AI inference provider (Anthropic’s Claude). Interprets free-text business descriptions and uploaded application documents into structured quote data. Only the business and underwriting context needed for this reasoning is sent; carrier credentials are never included.

All AI sub-processors we use maintain enterprise security certifications such as SOC 2 Type II and ISO 27001. The complete, current list is on our subprocessors page.

Authentication and access control

Agency users authenticate with email and password. Passwords are hashed with an industry-standard algorithm (bcrypt) and are never stored in a reversible form. Multi-factor authentication for agency user login is on our roadmap. (Carrier-portal MFA — the TOTP seed your agency stores for carrier logins — is already supported, and is distinct from agency user login MFA.)

Agency accounts support role-based permissions, so agency principals can control which team members have access to carrier credentials, client data, and billing settings.

Infrastructure and operations

Hosting. QuoteSweep’s application runs on Railway, which maintains SOC 2 Type II certification. Our managed Postgres database is hosted on Supabase, which also maintains SOC 2 Type II certification, runs on AWS, and encrypts data at rest with AES-256. Carrier credentials are stored separately in AWS Secrets Manager with KMS encryption, isolated from the application database.

Monitoring and logging. Application activity, authentication events, and security-relevant data access — such as credential reveals and role changes — are logged and monitored, with alerting for review by the engineering team.

Incident response. QuoteSweep maintains a documented incident response process. In the event of a confirmed data breach affecting your agency’s information, we will notify you within 72 hours of confirmation, with scope, impact, and remediation details.

Disaster recovery. Database backups are encrypted and taken daily, and we target recovery within 24 hours of a major infrastructure incident.

Regulatory alignment

QuoteSweep’s data-handling practices are designed to align with the requirements of:

• • Gramm-Leach-Bliley Act (GLBA) — financial data privacy
• • State insurance data privacy regulations
• • NAIC Insurance Data Security Model Law (where adopted)
• • California Consumer Privacy Act (CCPA) and similar state privacy laws

Reporting a security issue

If you become aware of unauthorized access or a vulnerability — or need security documentation for a vendor questionnaire — email security@quotesweep.com. Reports go directly to the engineering team.