Security & privacy
Built for the most sensitive answers your clients will ever give.
Life insurance applications contain health history, finances and identity documents. Here is how PolicyStream protects them, and what we ask of you.
Stored in Canada
PolicyStream runs on Amazon Web Services in the Canada (Central) region. Client data, documents and backups are stored in Canada.
Encrypted everywhere
All traffic uses TLS. Databases, files and backups are encrypted at rest with managed encryption keys.
Two-step sign-in
Every account can use an authenticator app, with trusted devices for 30 days. Owners and admins must use it once a team has more than one person, because they can see every advisor's clients.
Secure client links
Clients confirm who they are with a one-time code. Trusted devices are remembered and links expire.
Roles and access
Owner, admin and advisor roles. Advisors see only the clients assigned to them.
Audit trail
Views, edits, signatures, sends and exports are logged with who, what and when.
Tamper-evident documents
Compliance documents are frozen when sent and fingerprinted, so any later change is detectable.
Monitoring and backups
A web application firewall, alerting on unusual activity, automated backups and tested restores.
Least-privilege operations
Production access is limited to the people who need it, protected by MFA and logged.
Privacy
Your clients' information belongs to you and your clients.
You collect personal information from your clients and decide how it is used. PolicyStream stores and processes it on your behalf to provide the service. We don't sell it, we don't use it for advertising and we don't share it with carriers or anyone else unless you tell us to.
- Designed around PIPEDA and provincial privacy laws
- Export your data any time; deletion on request when you leave
- A short, named list of service providers
- Breach notification to affected account owners without undue delay
Shared responsibility
PolicyStream
- Secure hosting in Canada
- Encryption, MFA and access controls
- Monitoring, backups and patching
- Keeping forms and Autofill up to date
You, the advisor
- Client consent and your privacy notice
- Reviewing every answer before you submit
- Suitability, advice and disclosure
- Your licensing, MGA and regulator obligations
- Keeping your login and devices secure
Questions from your compliance team?
We're happy to fill in the questionnaire.
Brokerages and MGAs can request our security overview and service provider list. Email philip@policystream.ca.
Placeholder: confirm each control above against the live AWS setup before launch (WAF, backups/restore test, alerting)
Spend your time with clients, not paperwork.
Start your 14-day free trial. Your first client file takes about ten minutes.
Start free trial