Data Security and Privacy

In practice, this means:

• Authenticated customer queries are constrained by database policies even if application code issues an overly broad query
• There is no admin query mode that bypasses your data isolation
• Service-role database access is limited to account deletion workflows only — it cannot be used to read another user's financial data

RLS enforcement happens inside the database, not in application code. It is not possible to bypass it through the application layer.

Authentication Security

Policy Stack uses Supabase Auth with the following security practices:

• Magic link and Google OAuth — no passwords to steal or forget
• JWT-based sessions — short-lived, signed tokens
• Automatic session expiration — inactive sessions expire
• No session persistence across devices unless you explicitly log in on each device

Data Isolation

Every piece of data in Policy Stack is tied to your user ID. The combination of RLS and field-level encryption means:

• Your data is isolated from all other users at the database level
• Encrypted values are tied to your encryption keys
• Even if a database were somehow extracted, your financial values would not be readable without the application-layer keys

What We Store

Policy Stack stores only what you provide:

• Account information (email, display name)
• Policy data you enter (carrier name, policy details, snapshots)
• Loan and deployment records you create
• Documents you upload
• Goals and scenarios you create
• AI conversation history (within your account, not used for model training)

Policy Stack does not:

• Store your carrier login credentials
• Scrape data from your carrier's website
• Connect to financial institutions directly
• Share your data with third parties (other than your explicitly connected advisors, as described in the Connecting with an Advisor article)

Data Retention and Deletion

Your data remains in Policy Stack as long as your account is active. If you delete your account:

Account deletion triggers a complete data removal process. All your records — policies, loans, deployments, snapshots, goals, documents, and AI history — are permanently deleted. This process cannot be reversed.

Questions and Concerns

If you have a specific security question or concern:

• General security questions: support@policystack.co
• Security vulnerability reports: security@policystack.co

Policy Stack takes security reports seriously and will respond to vulnerability disclosures promptly.

Policy Stack is a tracking and visualization tool. It does not provide financial advice, recommendations, or opinions on what you should do with your banking system.

Policy Stack is independent of and is not affiliated with, sponsored by, or endorsed by Infinite Banking Concepts, LLC or the Nelson Nash Institute.