Built like the data actually matters. Because it does.
Policyholder data is sensitive. We architect, audit, and operate Policy Growth like a financial-grade system — not a marketing tool with a privacy page.
The non-negotiables.
Encrypted in transit
TLS 1.2+ on every connection. Strict ciphers. HSTS enforced. Annual cert audits.
Encrypted at rest
AES-256 on every database, object store, and backup. Customer-managed keys available on Agency plans.
Least-privilege access
Role-based access controls. Just-in-time elevation for production. All access logged.
MFA required
MFA mandatory for every staff member. SSO available on Growth and Agency plans.
AI training boundary
Your customer data is never used to train models without your explicit written consent.
Tested quarterly
Independent pen tests every quarter. Bug bounty program for responsible disclosure.
Audited annually by an independent firm. Report under NDA.
BAA available for medical-line policies.
EU residency available. Standard Contractual Clauses for transfers.
Compliant for California residents. Privacy requests via privacy@.
See something? Say something.
If you believe you've found a security vulnerability in Policy Growth, please email security@policygrowth.co with reproduction steps. We respond within 24 hours.
We run a private bug bounty program for verified researchers. Contact security@ to be invited.
Need our SOC 2 report?
We share the full report under NDA. Email security@ and we'll send the NDA in under an hour.