Security overview
A plain-English summary of the security practices guiding the SmartQuotes platform across encryption, access, logging, cloud infrastructure, and API protection.
Encryption
SmartQuotes is designed to use encrypted connections for web and API traffic. TLS/HTTPS is expected for production-facing routes and enterprise review environments.
Authentication and access
Administrative access should be limited to authorized users, protected with strong authentication, and reviewed as part of the enterprise readiness program.
Authorization
Access should follow least-privilege principles, with administrative and operational access separated from public customer experiences.
Audit logging
Material administrative and system events should be logged to support accountability, troubleshooting, and future security review.
Cloud infrastructure
SmartQuotes is deployed using cloud-native infrastructure patterns designed to support secure configuration, repeatable deployment, and future control evidence.
API security
APIs should be protected through authentication, authorization, validation, rate limits where appropriate, and structured logging.
Data handling
Customer intake data, partner appetite configuration, and operational records should be treated according to classification, retention, and access-control rules.
Security monitoring
Security monitoring should focus on access events, application errors, unusual activity, and infrastructure health signals.
For enterprise review
Highlights for review
- HTTPS/TLS for public access
- Security headers deployed
- Report-Only CSP in place for compatibility testing
- Public security contact
- Security documentation available by request