Security, stated plainly.

Relay carries insureds' personal information between licensed insurers and agencies. This page lists the controls in place, and says where we aren't certified yet.

Compliance status

SOC 2: Not certified. We haven't completed an audit. When an audit is underway we'll say so here, and when a report exists we'll share it under NDA.
Insurance data security laws: Carriers and agencies we serve are licensees under state insurance data security laws and NYDFS Part 500. Our Data Processing Addendum carries the service-provider terms they need, including incident notice.
GLBA: We act as a service provider to financial institutions, and apply Safeguards-style controls to the nonpublic personal information we process.
Payments: Card payments run on Stripe Checkout. Relay never sees or stores card numbers.

Data protection

Encryption: TLS in transit. At rest, every organization has its own data key, wrapped by a key-encryption key. Raw files and policy objects are stored encrypted in private storage.
Field-level encryption: Driver license numbers, tax IDs and dates of birth are encrypted individually, masked by default, and every reveal is written to the audit log.
Thin webhooks: Webhooks carry a summary and a link, never full personal data. Partners fetch details over the authenticated API, so personal data stays out of webhook logs and retry queues.
Retention: Raw files and policy objects are purged after 13 months. Deleting an organization destroys its data key, so any remaining ciphertext can't be decrypted.
AI: AI reads only PDFs an agency uploads itself, under zero-retention terms with our model provider. Results are always held for human review. No AI runs on carrier files.

Access control and isolation

Tenant isolation: Every query is scoped to the organization and environment from the session or credential, never from a URL or request body. Postgres row-level security enforces the same rule underneath. Other tenants' IDs return 404.
Isolation tests: An automated suite tries to read, edit and delete other tenants' records by changing IDs in URLs, bodies and headers, and runs before every release.
Authentication: Passwords are hashed with Argon2id and checked against known breaches. Two-factor authentication is required for owners, admins, developers and all Relay staff.
Staff access: Staff can't view customer data without a time-limited, reasoned break-glass session that the customer can see in its audit log.
Credentials: API keys, tokens and one-time codes are random, stored only as hashes, and compared in constant time. Secrets are shown once.

Sub-processors and reporting

The vendors that process data for Relay are listed on the sub-processors page. To report a vulnerability, email security@emeraldrelay.com. Please include steps to reproduce. We won’t pursue legal action over good-faith research that avoids customer data.