Security

Our Commitment

At BotMakers, Inc., we understand that insurance data is highly sensitive. SmartViewz handles agent NPNs, Tax IDs, policy details, premium amounts, and commission data. We take the security of this information seriously and have implemented comprehensive measures to protect it.

Infrastructure Security

• Hosting: SmartViewz is hosted on Vercel's enterprise-grade infrastructure with automatic DDoS protection, edge network distribution, and SOC 2 compliant data centers
• Database: All data is stored in Supabase (PostgreSQL) with encryption at rest (AES-256) and in transit (TLS 1.3)
• CDN: Static assets are served through Vercel's global edge network with automatic HTTPS

Data Isolation

• Row-Level Security (RLS): PostgreSQL RLS policies enforce strict data isolation between organizations at the database level. Even if application logic fails, the database prevents cross-org data access
• Org-Scoped Queries: Every API request is scoped to the authenticated user's organization via getUserContext() and org_id filtering
• Role-Based Access Control: Hierarchical access controls ensure agents see only their own data, supervisors see their downline, and admins see their full organization
• Multi-Org Membership: Agents belonging to multiple organizations have completely isolated data views per org, with validated membership checks on every request

Authentication and Access

• Secure Authentication: Powered by Supabase Auth with server-side JWT verification via getUser() (not client-side session checks)
• NPN Verification: Individual agent accounts require a verified National Producer Number linked to synced agency data
• Rate Limiting: Sensitive endpoints (login, NPN verification, invite acceptance) are rate-limited to prevent brute force attacks
• Credential Protection: Smart Office API credentials are stored server-side only and never exposed to client applications or API responses

Application Security

• Input Validation: All mutation endpoints use Zod schema validation to reject malformed or malicious input
• Security Headers: X-Frame-Options (DENY), X-Content-Type-Options (nosniff), Referrer-Policy, and Permissions-Policy headers are set on all responses
• CSRF Protection: All state-changing operations require authenticated JSON requests, preventing cross-site request forgery
• Ad-Blocker Bypass: Error monitoring data is tunneled through /monitoring to ensure security events are captured even when ad-blockers are active

Monitoring and Incident Response

• Error Tracking: Sentry monitors all runtime errors across client, server, and edge environments with source-mapped stack traces
• Sync Health Monitoring: Automated AI-powered health checks analyze sync performance daily, with anomaly detection for data integrity
• Audit Logging: Administrative actions are logged for accountability and forensic analysis
• Alerting: Automated alerts notify our engineering team of errors, performance degradation, and security anomalies

Data Processing

• AI Processing: AI features are powered by Anthropic's Claude API. Data sent to Claude for analysis is processed in accordance with Anthropic's enterprise data handling policies and is not used for model training
• No Data Selling: We never sell, rent, or trade your data to third parties
• Data Minimization: We collect and process only the data necessary to provide the Service

Compliance

SmartViewz is built entirely on SOC 2 Type II certified infrastructure. Every vendor in our stack has been independently audited for security, availability, and confidentiality controls.

BotMakers, Inc. follows SOC 2 security controls internally and is actively pursuing our own SOC 2 Type II certification. We are happy to discuss our security practices in detail during your onboarding session.

Reporting Security Issues

If you discover a security vulnerability, please report it responsibly to:

BotMakers, Inc.
Email: security@botmakers.ai
Phone: (866) 753-8002

We take all security reports seriously and will respond within 48 hours.