Security and controls

Benefit documents carry personal data. The controls below apply to every campaign, and the details are available to client security teams on request.

Transport and storage

• TLS 1.2 or higher on every endpoint; HTTP Strict Transport Security enabled; older protocol versions refused.
• Documents and eligibility files encrypted at rest with AES-256. Encryption keys are held in AWS KMS with annual rotation.
• SFTP accounts use key-based authentication only; passwords are not offered.
• Retrieval links are single use, expire after 72 hours, and are bound to the employee ID they were issued for.

Access to production data

• Staff access requires a named account with a hardware security key. Shared accounts do not exist.
• Access is granted per campaign and revoked when the campaign closes.
• Every file access and every report export is logged with the account, the campaign and the timestamp. Logs are kept for 12 months and available to clients on request.
• Access rights are reviewed quarterly and after any staff change.

Retention and deletion

Documents remain available to the employee for 24 months from the send date. Eligibility files are deleted 30 days after campaign close unless the contract states otherwise. On request we return a deletion confirmation listing the files removed and the date of removal.

Sub-processors

Provider	Purpose	Location
Amazon Web Services	Hosting, storage, encryption key management	United States (us-east-1)
Mailgun Technologies	Outbound email delivery and bounce processing	United States / European Union
Twilio	One-time codes for document retrieval by SMS	United States

The current list is maintained in the privacy policy. Clients are notified 30 days before a new sub-processor handles personal data.

Incident handling

Confirmed incidents affecting client data are reported to the client contact of record within 72 hours, with the scope, the affected campaigns and the containment actions taken. A written post-incident report follows within 10 business days.

What we do not do

• We do not sell, rent or share eligibility data with third parties for their own purposes.
• We do not use client data for marketing, profiling or product development.
• We do not send documents to addresses outside the file you approve.