Security & Data Handling

Private document storage

COIs, W-9s and supporting files are stored in private application storage. Uploads use time-limited signed URLs, source-document viewing uses short-lived private read URLs, and file bytes do not need to pass through the application database. If a transfer fails, Covrion attempts to remove the incomplete record and reports whether cleanup was confirmed. If cleanup cannot be confirmed, refresh the document list and retry removal; an error message is not proof that a file was erased.

Document format checks

Workspace uploads inspect supported file headers before transfer. Before AI extraction, the server checks the stored file header against its recorded format and verifies the 20 MB size limit. These are format checks, not antivirus scanning, full document validation or proof of authenticity. The public document checker runs locally and does not upload file contents.

Tenant isolation

Workspace records are scoped to the authenticated organization in server-side application queries. Subcontractor, payment, document, renewal and billing operations validate workspace ownership before changes are made.

Authentication

Covrion uses authenticated sessions and password hashing. Protected requests validate signed cookies and the stored session, including its expiry. New password registrations enforce minimum length plus uppercase, lowercase and numeric characters. Email identity is matched without regard to capitalization. Authentication responses are marked private and no-store.

Account security lets you review your session count, sign out everywhere, and change your password after verifying the current password. A successful password change ends all existing sessions. Failed credential checks are rate limited. Signing out alone does not change a compromised password. Forgotten-password recovery sends a single-use link to the registered email address. Links expire after 15 minutes; only a hash of each token is stored. A successful reset invalidates all existing sessions and outstanding reset links. Requests are rate limited and return the same message whether or not an account exists.

Password-change alerts

After a successful password change or reset, Covrion attempts to send an informational notice to the registered email address. Notices never contain your password or a reset token. Email delivery problems do not reverse a completed password change. If you receive an unexpected notice, secure your email account, use password recovery and contact support.

Payments

Stripe handles subscription payment processing. Stripe secret credentials are used only in server-side code. Covrion does not store complete card numbers.

AI extraction controls

Document extraction runs server-side. Low-confidence or incomplete extractions are marked for review. Impossible, reversed or incomplete policy-date pairs are excluded from reconciliation and require review. Extraction instructions treat document contents as untrusted data and prohibit returning tax identifiers, signatures and bank details; these instructions are not a guarantee that AI output is free of mistakes or sensitive information. Review the source and extracted fields before using them. Matching recorded dates does not establish insurance coverage.

Audit-readiness calculations

Payment exposure is computed from imported payment dates and currently processed coverage periods. This is an evidence-reconciliation model, not an insurance underwriting decision.

Operational safeguards

• Duplicate payment imports are fingerprinted to reduce accidental double counting.
• Renewal tasks are scoped to organizations and resolve when newer processed coverage is added.
• Generated audit packets are created on demand and are not cached publicly.
• Billing state is refreshed from Stripe for linked subscriptions, with refreshes throttled to reduce unnecessary external calls.
• Meaningful imports, evidence changes, renewal actions, policy changes and audit-packet generation are written to an organization-scoped activity trail.
• Evidence deletion requires a successful storage response before removing the document record. Activity history may retain the filename and subcontractor name. Time-limited upload URLs cannot be revoked immediately. Deleted file keys are recorded transactionally with removal of the document record. The cleanup routine checks for late uploads, skips files still referenced by a document, and retains failed checks. Scheduled rechecks are currently paused because they require a paid hosting plan; pending records are retained. A successful check at least seven days after deletion retires the cleanup record. Contact us for broader erasure requests.
• Published pages restrict framing to the same origin to reduce clickjacking risk.

Backup and file recovery

Database exports preserve structured records and file references, not private source-file contents. Recovery therefore requires both a usable database backup and the corresponding source files. An isolated export restoration and a synthetic private-file copy, deletion and restoration drill were completed on October 11, 2026. These checks do not establish provider-managed point-in-time recovery, recovery of every historical file, or guaranteed recovery times. Keep independent copies of business-critical documents and contact support promptly about data loss.

Responsible disclosure

Report security concerns to syndicatehubllc@gmail.com with the subject “Covrion security report”. Include the affected page, approximate time, impact and minimal reproduction steps. Remove personal information and secrets from screenshots. Do not send passwords, session tokens or private evidence files. This contact does not authorize accessing other users’ data, disrupting the service or testing third-party systems.