Security & Data Protection

Your agency trusts Insurance Agent App with your clients’ policy data. This page explains how IA App protects it. Plainly, and without overstatement.

How policy data reaches IA App

Policy data comes directly from your agency management system through authorized integrations with AMS360, EZLynx, HawkSoft, Momentum (powered by NowCerts), and QQCatalyst. Where the AMS supports it, connections use OAuth 2.0, so your agency grants access without sharing passwords. Integration credentials are encrypted before they are stored.

Who builds and runs the platform

Blue I, LLC, dba Insurance Agent App, is based in Charlotte, NC. IA App is responsible for the platform, its security program, and every decision about who can access data.

Development, testing, and cloud operations are performed for IA App by a U.S.-headquartered software engineering firm. Access to production systems is limited to a small number of named individuals, each using their own account, and is granted only by IA App.

Where the platform runs

The platform is hosted on Google Cloud Platform in the USA. Uploaded files and images are stored in private, access-controlled Amazon Web Services storage that is not publicly accessible. Both providers operate enterprise-grade data centers with physical and network security controls that are independently audited.

How data is protected

  • All data in transit is encrypted with TLS 1.3. Our configuration holds an A+ rating from Qualys SSL Labs.
  • Data at rest is encrypted by our cloud providers.
  • Passwords are never stored in plain text. They are hashed with bcrypt, an industry-standard one-way algorithm.
  • Sensitive fields, such as driver’s license numbers, are masked on screen.

Who can see your agency’s data

  • Each agency sees only its own data. That separation is built into the application code, not just policy.
  • Agency staff, IA App administrators, and policyholders sign in through separate, purpose-built login flows with role-based permissions.
  • Mobile and API access uses short-lived tokens that expire automatically and are revoked when credentials change.
  • Any security event ends all active sessions on every device.
  • Sign-in activity, including time and IP address, is logged for every user.
  • IA App’s support team accesses agency data only to deliver and support the service.

Your data stays yours

IA App does not sell or sublicense agency or policyholder data. Agency data is used only to deliver the service.

Monitoring and vulnerability management

  • Real-time error monitoring and alerting across the platform notify our engineering team of anomalies.
  • Our engineering team scans the platform for vulnerabilities on a regular schedule and remediates findings.

Strengthening our program

Security is ongoing work. IA App is expanding its written security program, including formal access reviews, incident response planning, and independent penetration testing.

Questions

Agencies, carriers, and AMS partners can request additional security detail, including completed security questionnaires, by contacting Contact@InsuranceAgentApp.com. Some materials are shared under a nondisclosure agreement.