Security & Trust

Our commitment

Belong Benefits helps insurance brokers turn benefit documents into clear, shareable guides for employees. That means we handle information brokers and their clients care deeply about — plan details, contact information, and the documents behind them. Protecting that data is foundational to the product, not an afterthought. This page describes the controls we have in place today.

Infrastructure & data protection

• Encryption in transit: all traffic is served over HTTPS with TLS 1.2+. HTTP requests are redirected to HTTPS, and HSTS is enabled with preload.
• Encryption at rest: databases and uploaded documents are encrypted at rest (AES-256) by our infrastructure providers.
• Reputable, compliant infrastructure: we build on providers that maintain their own SOC 2 (and in several cases HIPAA/HITRUST) attestations — see Subprocessors below. Our database and hosting run in the United States, and uploaded documents are stored in North America.
• Secrets management: API keys and credentials are stored as environment secrets, never committed to source control, and never exposed to the browser.

Application security

• Tenant isolation: every database query is scoped to the requesting organization. Brokers see only their own clients, plans, and documents. Another organization sees a guide only when the broker grants it access: by sharing the guide with the client’s HR, or by accepting a sponsor’s seats, which shows the sponsor that guide’s status and, on collaborative seats, lets the sponsor help edit it.
• Authentication on every protected route: access to broker data requires an authenticated session; public benefit guides are gated by unguessable links and publish/expiry controls.
• Input validation: all incoming requests are schema-validated before any data is processed, and all database access uses parameterized queries (no string-built SQL).
• Hardened browser policy: a strict Content-Security-Policy, anti-clickjacking (frame-ancestors), MIME-sniffing protection, and a least-privilege Permissions-Policy are enforced on every response.
• Rate limiting: public endpoints, including the assistant chat, are rate-limited per client to prevent abuse.
• Tests on every security-sensitive change: any change touching authentication, authorization, or access control ships with a regression test in the same change, and must pass an automated review before it merges — not added after the fact.
• Automated enforcement: security rules (authorization, input validation, safe data handling) are checked automatically on every code change and must pass before anything ships.

AI & document handling

• We use enterprise AI providers to extract plan data from documents and to power the employee-facing assistant. Content extracted from documents is sanitized before it reaches any AI prompt.
• Your data is not used to train third-party foundation models. AI providers act as subprocessors under contract and process data only to deliver the service.
• The assistant is scoped to a single published guide and cannot access other organizations’ or clients’ data.

Access control & monitoring

• Least-privilege access: internal access to systems and customer data is limited to what a role requires.
• Monitoring: application errors and anomalies are continuously monitored, with alerting for issues that could affect availability or integrity.
• Incident response: we maintain a process to investigate, remediate, and — where required — notify customers of security incidents.

Data retention & deletion

We keep data only as long as it serves the purpose it was collected for. Specific retention windows for account data, usage analytics, and chat history are documented in our Privacy Policy. If your organization needs data deleted ahead of its normal retention window, contact us and we will process the request.

Compliance

Belong Benefits is actively pursuing SOC 2 Type II. The technical controls above are already in place; the remaining work is the formal policy program and independent audit. If you are evaluating us and need security documentation, a questionnaire completed, or a mutual NDA, contact us at jack@belongbenefits.com.

Subprocessors

We use the following providers to deliver the service. Each maintains its own security program and compliance attestations.

Infrastructure & hosting

• Vercel — application hosting and delivery
• Supabase — database and authentication
• Cloudflare R2 — document and media storage
• Inngest — background job processing
• Sentry — error monitoring
• Upstash — rate limiting, view counts, and short-lived (60-second) caching of published guides

AI providers

• Anthropic — AI document extraction and assistant
• OpenRouter — AI provider failover
• OpenAI — AI document reading and internal quality reporting
• TypeSafe AI — checking extracted plan details against the source document

Communications & billing

• Microsoft 365 — all email we send (invitations, sign-in and account emails, notifications)
• Stripe — billing and payments

Support

• GitHub — tracking support requests and product fixes, which may quote the feedback you send us

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability, please email security@belongbenefits.com with details and steps to reproduce. Please give us a reasonable opportunity to investigate and remediate before any public disclosure, and avoid accessing or modifying data that is not your own. We acknowledge reports within 3 business days. Our full disclosure policy is published at /.well-known/security.txt.

Contact

Questions about our security program? Reach out:

Belong Benefits Inc
Austin, Texas
Email: jack@belongbenefits.com
Website: belongbenefits.com