Security

Enforced in the database, not the application. Every table carrying customer data has PostgreSQL row-level security enabled, and each policy is scoped to the authenticated account. As of this review that is all 38 tables in the application schema — claims, clients, photos, documents, estimates, correspondence, signatures, AI memory, and billing records included. An application bug cannot leak another subscriber's row, because the request never gets past the database.

No cross-account data flow. No feature reads one subscriber's claims, documents, letters, or AI memory into another subscriber's session or prompt. There is no shared pool of claim data.

Isolation is tested adversarially, not assumed. Cross-tenant read and write attempts are part of the test suite and are re-run against production infrastructure on a throwaway account before releases that touch data access.

We do not train models on your data. Your claims, documents, and letters are never used to train or fine-tune any model, ours or a provider's.

AI processing runs server-side. Document extraction, rebuttal drafting, and claim analysis execute on the server. Inference keys are held server-side and are never shipped to the browser.

Only what a feature needs. An AI request carries the claim you are working on, the documents attached to it, and your own account's stored strategy notes. It does not carry your other clients, and it cannot carry anyone else's.

Bring your own key. On the BYOK plan you supply your own inference key, which puts the provider boundary under your contract rather than ours.

In transit. TLS on every connection, with HTTP Strict Transport Security sent with a one-year max-age, subdomains included, and preload.

At rest. AES-256 on the database and file storage, provided by our infrastructure vendor.

Browser hardening. A Content-Security-Policy with no unsafe-inline script source and script hashes computed at build time, plus frame-ancestors 'none', X-Frame-Options DENY, nosniff, a restrictive Referrer-Policy, and a Permissions-Policy that denies the microphone outright. Run curl -I https://adjusterospro.com and read them yourself.

Files are not public. Claim photo and document buckets are private. Files are reached through short-lived signed URLs issued to the owning account, never a public link.

Passwords. Hashed with bcrypt before storage. We cannot read your password, and neither can anyone who obtains the database.

Two-factor authentication. Available on every account from Settings, using any standard authenticator app. Once it is on, a stolen password is not enough to reach your claims — a sign-in that has not passed the second factor is refused the workspace outright rather than being allowed to read first. Enrolment issues single-use recovery codes so a lost phone is a nuisance rather than the end of your claim book. Those codes are shown to you once and stored only as slow hashes, which means we cannot read them, recover them, or hand them to anyone who asks us to.

Authentication events are logged. Sign-ins, sign-outs, and failed attempts are recorded with IP for security monitoring only — not analytics, advertising, or profiling.

Card data never touches us. Billing runs through Stripe, which is PCI-DSS Level 1. We hold a customer ID and a subscription status. We never see, store, or process a card number.

Client portal links can be shut off. A portal link you issue to a policyholder can be revoked and reissued at any time, which withdraws access from anyone the original link was forwarded to.

Chain of custody on capture. Field photos retain camera-sensor timestamps and capture GPS, device-ordered so the sequence is tamper-evident, and assembled into a forensic pack you can hand to counsel.

Nothing the AI asserts is unsourced. Statute and regulation lookups return the citation with a live source link, so a claim of law in a letter can be checked rather than trusted.

Your data is yours. Request a machine-readable export at any time and we return it within five business days. Close your account and we delete your data within thirty days, except where a legal hold requires otherwise. There is no lock-in clause that keeps your claim files hostage.

We would rather you verify than trust a logo, so these are third-party results you can reproduce against this domain right now — not badges we issued ourselves.

• Qualys SSL Labs: A+ on every endpoint. TLS 1.0 and 1.1 are refused outright, and the connection between our edge and our origin is validated rather than merely encrypted. Re-run it yourself.
• Mozilla Observatory: A+, 10 of 10 checks passed. Re-run that too.
• Submitted to the HSTS preload list — the list compiled into Chrome and Firefox themselves. Once included, those browsers refuse to touch this domain over plain HTTP even on a first visit. Check the status.
• Nobody can send email as us. Our domain publishes a DMARC policy of p=reject with strict alignment, so a forged “update your billing” message pretending to come from AdjusterOS Pro is refused by the receiving mail server rather than landing in your inbox. Verify with dig TXT _dmarc.adjusterospro.com.
• Only named certificate authorities can issue for our domain. CAA records pin issuance to a short list, so a rogue or tricked authority elsewhere cannot mint a working certificate for this site. Verify with dig CAA adjusterospro.com.
• A published security contact at /.well-known/security.txt, in the RFC 9116 format researchers look for.
• No known vulnerabilities in the shipped dependency tree, with automated dependency alerts watching for the next one.

Stated plainly, because a badge nobody earned is worse than no badge:

• We hold no compliance certification or audit report of our own. If you need one for procurement, ask us and we will tell you where we stand rather than send you a logo. Our payment processor is PCI-DSS Level 1; we are not, and we do not need to be, because card data never reaches us.
• No third-party penetration test on file yet. Our testing is internal and adversarial, which is not the same thing as an external assessment, and we will not describe it as one.
• Two-factor authentication is optional, not enforced. It is available to every account and we recommend it, but we do not currently require it — so an account without it is protected by a password alone, and that is the account holder's choice rather than a control we can point at.

If you find a flaw, tell us and we will fix it — no lawyers, no threats. Write to support@agentiqly.io with the words "security report" in the subject and we will acknowledge within two business days. We ask that you test only against your own account and never against another subscriber's data, and that you give us a reasonable window to fix an issue before publishing it.

For related detail, see the Privacy Policy on what is collected and who processes it, and the Terms of Service on retention after cancellation.