Security

Our Commitment

At BotMakers, Inc., we understand that insurance data is highly sensitive. SmartViewz handles agent NPNs, Tax IDs, policy details, premium amounts, and commission data. We take the security of this information seriously and have implemented comprehensive measures to protect it.

Infrastructure Security

• Hosting: SmartViewz is hosted on Vercel's enterprise-grade infrastructure with automatic DDoS protection and edge network distribution
• Database: All data is stored in Supabase (PostgreSQL), hosted on enterprise-grade infrastructure, and all connections are encrypted (HTTPS)
• CDN: Static assets are served through Vercel's global edge network with automatic HTTPS

Data Isolation

• Row-Level Security (RLS): PostgreSQL RLS policies enforce strict data isolation between organizations at the database level. Even if application logic fails, the database prevents cross-org data access
• Org-Scoped Queries: Every API request is scoped to the authenticated user's organization via getUserContext() and org_id filtering
• Role-Based Access Control: Hierarchical access controls ensure agents see only their own data, supervisors see their downline, and admins see their full organization
• Multi-Org Membership: Agents belonging to multiple organizations have completely isolated data views per org, with validated membership checks on every request

Authentication and Access

• Secure Authentication: Powered by Supabase Auth with server-side session verification (not client-side checks), with two-step verification required for platform administrators and available to every user
• NPN Verification: Individual agent accounts require a verified National Producer Number linked to synced agency data
• Rate Limiting: Sensitive endpoints (login, NPN verification, invite acceptance) are rate-limited to prevent brute force attacks
• Credential Protection: Smart Office API credentials are stored server-side only and never exposed to client applications or API responses

Application Security

• Input Validation: All mutation endpoints use Zod schema validation to reject malformed or malicious input
• Security Headers: X-Frame-Options (DENY), X-Content-Type-Options (nosniff), Referrer-Policy, and Permissions-Policy headers are set on all responses
• CSRF Protection: All state-changing operations require authenticated JSON requests, preventing cross-site request forgery
• Ad-Blocker Bypass: Error monitoring data is tunneled through /monitoring to ensure security events are captured even when ad-blockers are active

Monitoring and Incident Response

• Error Tracking: Sentry monitors all runtime errors across client, server, and edge environments with source-mapped stack traces
• Sync Monitoring: Every sync job is recorded, and failed or slow syncs are visible to our team in the admin console
• Audit Logging: Administrative actions are logged for accountability and forensic analysis
• Alerting: Automated alerts notify our engineering team of errors and performance problems

Data Processing

• AI Processing: AI features are powered by Anthropic's Claude API. Data sent to Claude for analysis is processed in accordance with Anthropic's enterprise data handling policies and is not used for model training
• No Data Selling: We never sell, rent, or trade your data to third parties
• Data Minimization: We collect and process only the data necessary to provide the Service

Compliance

SmartViewz runs on vendors that publish independent security audits, listed below.

BotMakers, Inc. is working toward its own SOC 2 Type II report; SmartViewz itself is not yet SOC 2 certified. We are happy to discuss our security practices in detail during your onboarding session.

Reporting Security Issues

If you discover a security vulnerability, please report it responsibly to:

BotMakers, Inc.
Email: security@botmakers.ai
Phone: (866) 753-8002

We take all security reports seriously and will respond within 48 hours.