Security model
StrataCover Network uses provider-managed encryption in transit and at rest, private storage, database-enforced access policies and server-side verification for privileged workflows. Security controls are layered so that a portal screen is never the sole access boundary.
Access and data protection
Identity & role boundaries
Access is resolved from protected role records rather than editable profile fields. Retail brokers are limited to their agency and authorized files; underwriters receive a restricted operational workspace; administrators retain program and financial controls.
Private document separation
Agency compliance records and submission-level policy documents are kept in separate private storage areas. Database policies and agency-aware access functions govern who can retrieve each record.
Time-limited insured intake
Insured questionnaires use single-use links that expire after 14 days. Only a cryptographic hash of each token is stored, and the link provides no portal, account, or file visibility.
Verified financial events
Payment events are signature-checked, restricted against replay, and reconciled against server-calculated amounts before a file is marked paid or bound.
Application and session safeguards
Server functions use cross-site request protections. Published responses prevent unauthorized framing, disable content-type sniffing and limit referrer information. Authenticated sessions end after 15 minutes of inactivity, and staff access is separated through Microsoft 365 sign-in and protected role assignments.
Operational integrity
Transactional notifications are authorized by database-triggered requests and protected against duplicate delivery. Submission and quote activity records preserve scoped evidence of material file changes. Automated analysis and market-routing suggestions remain advisory; underwriting and binding authority stay with authorized people and carriers.
Responsible security posture
No online service is “hack proof.” We review controls as the platform changes, keep secrets out of browser code, and distinguish implemented protections from planned testing or provider-operated safeguards. Security questions may be directed to allocations@stratacover.network.