Security

Implemented safeguards

• Cryptographic webhook signature verification for inbound messaging.
• Idempotency keys and deduplication for provider events and replies.
• Tenant isolation through server-resolved membership and row-level security.
• Outbound safety gates (automation, human takeover, allowlists, opt-out).
• Grounded retrieval and human-review escalation before consequential replies.
• Data minimisation: no card numbers, CVV, PINs or banking secrets stored.
• Demo fixtures segregated from live customer data.

Operational posture

InsurCall documents a pilot-stage security posture. Claims of certification, penetration testing, or compliance attestation must be based on actual evidence, not on the existence of these controls alone.

Reporting a vulnerability

Security reports should be sent to the InsurCall support address: lightlanister@gmail.com. Reports are handled through the existing support workflow pending a dedicated vulnerability channel.