Your banking system data is sensitive — cash values, death benefits, loan balances, and deployment details. Policy Stack treats data protection as a fundamental requirement, not an afterthought. Here is how your data is secured at every level.
Encryption at Rest
Financial values stored in Policy Stack are encrypted at rest using application-layer AES-256-GCM before database storage. This means:
- Cash values, death benefits, loan balances, premium amounts, and deployment values are encrypted in the database
- Even if someone gained access to the raw database, they would see encrypted data — not your financial figures
- The versioned encryption key is held in protected server configuration, not stored alongside the encrypted values
"Encryption at rest" means your data is encrypted when stored on disk. It is decrypted only when your authenticated session requests it.
Encryption in Transit
All communication between your browser and Policy Stack uses TLS/HTTPS encryption. This means:
- Data traveling between your device and the server is encrypted
- No one monitoring network traffic can read your data
- This applies to every page load, every API call, and every data sync
Row-Level Security (RLS)
Policy Stack uses row-level security at the database level. This is a PostgreSQL feature that ensures:
- You can only access your own data — no exceptions
- Every database query is filtered by your authenticated user ID
- Even if there were a bug in the application code, the database itself would reject unauthorized access
- There is no "admin override" that bypasses RLS
What this means in practice: Your policy data, snapshots, loan records, and deployment details are invisible to every other user in the system. The database enforces this, not just the application.
Authentication
Policy Stack supports two authentication methods:
Magic Link
- Enter your email address, receive a secure one-time link
- No password to remember, steal, or reuse
- Each link expires after use
- No credential storage risk
Google Sign-In
- Authenticate using your existing Google account
- Leverages Google's security infrastructure
- No separate password for Policy Stack
Both authentication methods are equally secure. Choose whichever is more convenient for you.
AI Data Handling
Policy Stack uses AI for features like the AI Assistant and AI Insights. Here is how your data is handled:
- AI processing happens on-demand when you use AI features
- Your data is sent to the AI model only for the specific request
- Your data is not stored by the AI provider after processing
- Your data is not used to train AI models
- AI features are opt-in — if you do not use them, your data is never sent to an AI model
No Third-Party Data Sharing
Policy Stack does not sell, share, or provide your data to third parties. Your data is used exclusively to provide the Policy Stack service to you.
Advisor Access (Builder Pro)
If you work with an advisor and grant them access:
- The permission level is disclosed when the relationship is created; sponsored seats use view-and-edit access, while some direct connections allow view-only
- You control access — you grant it and you can revoke it at any time
- Advisors see only the data you have authorized
- Access is logged
An advisor may send an invitation, but cannot access your consumer account until you accept the relationship. You can remove that access at any point. Document Vault sharing is a separate opt-in.
Account Deletion
If you choose to delete your account:
- In-app deletion immediately removes your consumer account and associated financial records from the active service
- Limited legal, billing, fraud-prevention, security, and dispute records may be retained where required; backup copies expire through normal rotation
- Records separately created and controlled by an advisor may remain in that advisor's practice records
- Deletion is irreversible — once confirmed, the data cannot be recovered
- We use a secure service-level process to ensure complete removal
Infrastructure
Policy Stack is built on:
- Supabase — enterprise-grade PostgreSQL database with built-in security features
- Vercel — secure hosting infrastructure with automatic SSL and DDoS protection
- Stripe — PCI-compliant payment processing (Policy Stack never sees or stores your credit card number)