How Policy Stack Protects Your Data

Your banking system data is sensitive — cash values, death benefits, loan balances, and deployment details. Policy Stack treats data protection as a fundamental requirement, not an afterthought. Here is how your data is secured at every level.

Encryption at Rest

All financial values stored in Policy Stack are encrypted at rest using Supabase Vault. This means:

• Cash values, death benefits, loan balances, premium amounts, and deployment values are encrypted in the database
• Even if someone gained access to the raw database, they would see encrypted data — not your financial figures
• Encryption keys are managed by the infrastructure, not stored alongside the data

Encryption in Transit

All communication between your browser and Policy Stack uses TLS/HTTPS encryption. This means:

• Data traveling between your device and the server is encrypted
• No one monitoring network traffic can read your data
• This applies to every page load, every API call, and every data sync

Row-Level Security (RLS)

Policy Stack uses row-level security at the database level. This is a PostgreSQL feature that ensures:

• You can only access your own data — no exceptions
• Every database query is filtered by your authenticated user ID
• Even if there were a bug in the application code, the database itself would reject unauthorized access
• There is no "admin override" that bypasses RLS

What this means in practice: Your policy data, snapshots, loan records, and deployment details are invisible to every other user in the system. The database enforces this, not just the application.

Authentication

Policy Stack supports two authentication methods:

Magic Link

• Enter your email address, receive a secure one-time link
• No password to remember, steal, or reuse
• Each link expires after use
• No credential storage risk

Google Sign-In

• Authenticate using your existing Google account
• Leverages Google's security infrastructure
• No separate password for Policy Stack

AI Data Handling

Policy Stack uses AI for features like the AI Assistant and AI Insights. Here is how your data is handled:

• AI processing happens on-demand when you use AI features
• Your data is sent to the AI model only for the specific request
• Your data is not stored by the AI provider after processing
• Your data is not used to train AI models
• AI features are opt-in — if you do not use them, your data is never sent to an AI model

No Third-Party Data Sharing

Policy Stack does not sell, share, or provide your data to third parties. Your data is used exclusively to provide the Policy Stack service to you.

Advisor Access (Builder Pro)

If you work with an advisor and grant them access:

• Advisor access is client-controlled — you can grant read/write access, read-only access, or no data access
• You control access — you grant it and you can revoke it at any time
• Advisors see only the data you have authorized
• Access is logged

Account Deletion

If you choose to delete your account:

• All of your data is permanently removed from Policy Stack
• This includes policies, snapshots, loans, deployments, goals, and any AI conversation history
• Deletion is irreversible — once confirmed, the data cannot be recovered
• We use a secure service-level process to ensure complete removal

Infrastructure

Policy Stack is built on:

• Supabase — enterprise-grade PostgreSQL database with built-in security features
• Vercel — secure hosting infrastructure with automatic SSL and DDoS protection
• Stripe — PCI-compliant payment processing (Policy Stack never sees or stores your credit card number)