> ## Documentation Index
> Fetch the complete documentation index at: https://watchmycover.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and privacy

> A summary of how WatchMyCover protects the certificates and data you hold, what is not yet in place, and what is collected.

You are putting other companies' insurance documents into WatchMyCover. This page summarizes what protects them and what does not yet. The full statements are the [security page](https://watchmycover.com/security) and the [privacy policy](https://watchmycover.com/privacy); if anything here differs, they take precedence.

## What we do not claim

WatchMyCover is **not** SOC 2 certified and **not** ISO 27001 certified. No third-party penetration test has been carried out. If your procurement process needs a certification, we do not have one to give you.

## What is in place

<AccordionGroup>
  <Accordion title="One customer cannot reach another">
    Every request is scoped to your organization, re-read from the database each time, and cross-organization access is covered by tests.
  </Accordion>

  <Accordion title="Documents are private">
    Certificate files are held in a private bucket with no public addresses. Every download goes through the app, is checked against your organization at that moment, and is recorded in the activity log. Only PDF, PNG and JPEG files are accepted, judged by their contents, up to 10 MB.
  </Accordion>

  <Accordion title="Confirmed addresses and two-factor sign-in">
    Accounts confirm their email address before using the app. Anyone can turn on [two-factor sign-in](/docs/account/two-factor) with an authenticator app and ten single-use backup codes; five wrong codes lock the account for 15 minutes.
  </Accordion>

  <Accordion title="Sessions">
    Session cookies are httpOnly and secure. Permissions are re-read on every request, so removing someone takes effect immediately. A password reset link works once, expires after an hour, and signs out every other session.
  </Accordion>

  <Accordion title="An audit trail">
    Every change is recorded: vendors, certificates, templates, projects, the team, share links, chasing, sign-ins, password and two-factor changes, document downloads and register exports. See [Activity log](/docs/account/activity-log).
  </Accordion>

  <Accordion title="Links that are credentials">
    Upload links, report links and invitations are long random tokens; only a hash is stored. Upload links in chase emails are created as each email is sent. Archiving a vendor withdraws their upload links. Report links expire within 90 days and can be revoked; upload and report links stop if the account is canceled.
  </Accordion>

  <Accordion title="Rate limits and input checks">
    Sign-in, registration and password reset are rate limited, as are reads, writes, imports and exports. Every request is validated. CSV imports are capped at 4 MB and uploaded files at 10 MB.
  </Accordion>

  <Accordion title="Exports cannot run formulas">
    A CSV cell beginning with a formula character is escaped, so an exported register cannot run a formula when opened.
  </Accordion>
</AccordionGroup>

## What is not in place yet

* **Two-factor sign-in is optional.** An owner cannot yet require it of the team.
* **Roles are broad.** Any member can import vendors, archive them and export the whole register. See [Team and roles](/docs/account/team-and-roles).
* **Two smaller gaps.** Subscription changes from the payment provider are applied but not recorded, and a single upload link cannot be withdrawn on its own: archiving the vendor withdraws them all.
* **Inline styles are allowed** by the browser security policy.

## Privacy in brief

* **What is collected:** your name, work email and company; what you enter (vendors, contacts, insurers, policies, limits, dates, templates, projects, verdicts); certificate documents you or your subcontractors upload; sign-in records, audit rows and server logs.
* **Your subcontractors' data** is held on your behalf and used only to do what you asked: check certificates, email for renewals, produce the reports you share. It is not used to market to them.
* **Not sold, not shared with advertisers.** There are no advertising trackers.
* **Analytics:** PostHog, US-hosted, with no cookie, no browser storage, no session recording and no automatic capture of clicks or typing. Events carry identifiers, counts and statuses only, never names, email addresses, certificate values or document contents. Pages whose address carries an upload, report, invitation or reset token send nothing.
* **Service providers:** Vercel, Render, Neon, Resend, PostHog and Stripe.
* **Retention:** superseded certificates are kept, because the history is what an audit asks for. Ask us to delete a closed workspace and we remove it, including documents, within 30 days, except what we are legally required to keep.

## Reporting a vulnerability

Write to [info@watchmycover.com](mailto:info@watchmycover.com) with enough detail to reproduce it. There is no bug bounty program.