Security

How we keep your records safe. Your policies, your people and their personal details, protected at every step.

Signing in

Everyone signs in with a second factor, an authenticator app. Without it, the database refuses the request.
Signed out means signed out: an ended session stops on its next request.
You can see the devices you are signed in on, and end any of them.
On Enterprise, your people sign in through your own identity provider.

Every record is guarded by the database's own access rules, so each person sees only what their role allows.
Every access rule is tested automatically on every change to the platform.

Medical details are read only by the person they belong to and our medical concierge team. Never by their employer, its HR or a broker.

Documents are kept in private storage. Each opens through a link that lasts a minute or two, issued only after we check you may see it.

Your records and documents are encrypted in transit and at rest. Identity numbers are encrypted a second time, by Covarage, inside the database.

Every change our team makes to your records is logged: who made it, what changed and when. When our team opens someone's personal details, that is logged too.
The log has no time limit, and no one can edit it through the platform.

Every change is checked automatically before release. A change to the database is reviewed and tested on a copy first.

The database is backed up every day, and a separate full copy of every record and file is taken and kept outside the platform.

We have a written incident response plan, and a personal data breach plan under Singapore's Personal Data Protection Act.

Your records, your documents and the platform's servers are in Singapore, and our emails are sent from Singapore.
WhatsApp and SMS messages pass through our messaging provider's United States region.
Our hosting provider may process operational data, such as logs, in the United States.
On Enterprise, your group can have a private instance in a region it chooses, or run Covarage on its own servers.

Supplier	What it does	Its certifications
Vercel	Hosts the platform	SOC 2 Type II; ISO/IEC 27001
Supabase	Database, sign-in and file storage	SOC 2 Type II; ISO/IEC 27001
Amazon Web Services	Email	ISO/IEC 27001; SOC 1, 2 and 3
Twilio	WhatsApp and SMS	ISO/IEC 27001, 27017 and 27018; SOC 2 Type II (company-wide)

Each supplier publishes its reports on its own trust page.

We have begun our groundwork for Singapore's Cyber Trust mark and Data Protection Trustmark.

Enterprise customers receive a written technical overview for their IT team's review, and an independent penetration test before go-live.

Questions from your IT or security team?

To report a security issue, write to support@covarage.com with Security in the subject.