Data Security and Privacy

Your banking system data is sensitive. Policy Stack is built with security at the infrastructure level — not as an afterthought.

Field-Level Encryption

Every financial value in Policy Stack is encrypted at the field level before it is stored in the database. This means that even at the database layer, financial values are not stored as plain text.

Encrypted fields include:

• Cash value amounts
• Death benefit amounts
• Loan balances
• Premium amounts
• Deployment values and return rates
• Cash flow amounts
• All other financial figures across policies, loans, deployments, and snapshots

Field-level encryption is handled through Supabase Vault. Each encrypted value uses a separate encryption key. The encryption and decryption happen at the application layer — the database stores ciphertext, not plaintext values.

Row-Level Security (RLS)

Policy Stack uses row-level security on every database table. RLS is a database-level enforcement mechanism that ensures queries can only return rows that belong to the authenticated user.

In practice, this means:

• Your query results can never include another user's data, even if a bug in application code issued an overly broad query
• There is no admin query mode that bypasses your data isolation
• Service-role database access is limited to account deletion workflows only — it cannot be used to read another user's financial data

RLS enforcement happens inside the database, not in application code. It is not possible to bypass it through the application layer.

Authentication Security

Policy Stack uses Supabase Auth with the following security practices:

• Magic link and Google OAuth — no passwords to steal or forget
• JWT-based sessions — short-lived, signed tokens
• Automatic session expiration — inactive sessions expire
• No session persistence across devices unless you explicitly log in on each device

Data Isolation

Every piece of data in Policy Stack is tied to your user ID. The combination of RLS and field-level encryption means:

• Your data is isolated from all other users at the database level
• Encrypted values are tied to your encryption keys
• Even if a database were somehow extracted, your financial values would not be readable without the application-layer keys

What We Store

Policy Stack stores only what you provide:

• Account information (email, display name)
• Policy data you enter (carrier name, policy details, snapshots)
• Loan and deployment records you create
• Documents you upload
• Goals and scenarios you create
• AI conversation history (within your account, not used for model training)

Policy Stack does not:

• Store your carrier login credentials
• Scrape data from your carrier's website
• Connect to financial institutions directly
• Share your data with third parties (other than your explicitly connected advisors, as described in the Connecting with an Advisor article)

Data Retention and Deletion

Your data remains in Policy Stack as long as your account is active. If you delete your account:

Account deletion triggers a complete data removal process. All your records — policies, loans, deployments, snapshots, goals, documents, and AI history — are permanently deleted. This process cannot be reversed.

Questions and Concerns

If you have a specific security question or concern:

• General security questions: support@policystack.co
• Security vulnerability reports: security@policystack.co

Policy Stack takes security reports seriously and will respond to vulnerability disclosures promptly.