Security

Account and workspace safeguards

Supabase handles authentication. New trial access requires email verification, and password recovery uses account email. Server endpoints verify signed-in accounts and enabled agent access. Database row-level rules separate workspaces and restrict agent-owned records. Agency oversight does not grant unrestricted access to another agent's mailbox or private profile records.

The production site uses HTTPS. Server responses include anti-framing, content-type and referrer protections, and sensitive routes use private, no-store caching. Provider secrets and service credentials are kept server-side. These safeguards reduce risk but cannot guarantee that an incident will never occur.

Mailbox and AI controls

Mailbox connections use OAuth-state validation and encrypt stored tokens with AES-256-GCM on the server. Reads and sends are checked against mailbox ownership and client permissions. Duplicate-send controls avoid automatically resending an uncertain send.

AI requests use authorized context, exclude free text by default and have workspace usage limits. The assistant cannot automatically send messages or change client records. Redaction is not a reliable medical-data filter.

Protect your information

Use a unique password, protect your account and remove team access when it is no longer needed. Maintain independent copies of records required for your business. Do not submit medical records, completed health applications, diagnoses, medications, other medical details, Social Security numbers, passwords or payment credentials.

This page describes implemented safeguards; it does not claim a regulatory certification or guarantee compliance with HIPAA, GDPR or other requirements. Do not assume the service is suitable for protected medical information.

Report a security or privacy issue

Email support@kaisurance.com with a short description, the affected page and approximate time. Mendy Douglas monitors support, privacy and security requests. Do not include passwords, secret keys, verification links or confidential client records. Ask for a suitable way to share sensitive evidence if needed. Do not access another user's data or disrupt the service while investigating.