Security Overview

Encryption in Transit

All connections to Inbound Underwriting are served exclusively over HTTPS/TLS — there is no unencrypted HTTP access to the application or its API. This protects documents and data in transit between your browser and our servers.

Our server enforces TLS 1.3, the current version of the protocol, using modern AEAD ciphers (TLS_AES_256_GCM_SHA384). Older, weaker TLS versions are not accepted.

Access Control & Data Isolation

Every account authenticates via signed, time-limited session tokens. Every request for documents, analyses, or exports is scoped to the authenticated user's own organization at the application layer — there is no code path that allows one organization to query or retrieve another organization's data. Administrative actions are further restricted to designated organization administrators.

Document Handling

Source documents you upload are used only for the single extraction you request, and are automatically and permanently deleted from our servers as soon as that extraction completes — well before any export file is generated from the result. A scheduled cleanup process provides a backstop, removing any file left behind by an interrupted process within the hour. See our Privacy Policy for what data is retained after that point (extracted metrics, kept as your analysis history) and what is not.

Infrastructure

The application runs on server infrastructure we control directly. Every request is scoped to the authenticated user's own organization at the application layer, so one organization's data is never accessible to another's. Background processing of document extraction runs as a separate process from the request-handling layer, so a single long-running analysis cannot affect the availability of the application for other users.

Third-Party Processing

Document text is sent to a third-party AI model provider (OpenAI or Anthropic, depending on configuration) solely to perform the requested data extraction, under that provider's own data-handling terms. No other third party receives document content.

Reporting a Security Concern

If you believe you've found a security issue affecting Inbound Underwriting, please report it to security@inboundunderwriting.com. We take all reports seriously and will respond promptly.