Security and privacy at CoverMatch

How we protect your business's information

QUICK ANSWER

CoverMatch stores your policies and documents in private, encrypted storage with short-lived links, encrypts tax IDs and payroll figures at the field level, isolates every business's data from every other, requires multi-factor sign-in for staff, and never sells or shares your information with lead buyers. You can export or delete your data from the account screen at any time.

Reviewed by Michael LaBarbera, Licensed property & casualty agent, Provident Financial Group · Reviewed Oct 12, 2026 Updated Oct 14, 2026

What we store

The policies, declarations pages, certificates and contracts you bring in or that carriers send on your behalf.
Business details needed to quote: legal name, address, what the business does, size, and the tax ID and payroll where a line requires them.
Your contact details and the consents you have given, each with the exact wording and version you agreed to.
A log of what happened to your account: who viewed what, what was sent where, and every automated decision with its reasons.

How it is protected

Encryption. Documents sit in private storage that is never publicly reachable; links to open them expire within minutes. Tax IDs, Social Security numbers and payroll figures are encrypted at the field level with keys held in a managed key service, separate from the database.

Isolation. Every record belongs to a business, and every query is scoped to the businesses a signed-in member belongs to. Tests that prove one member cannot read or change another's rows run on every change to the software.

Access. Staff use separate accounts with required multi-factor authentication. Support access to a customer's wallet is read-only and audit-logged. Nobody shares logins.

Sign-in without passwords. Members sign in with Apple, Google, or a one-time code sent by email. There is no password to leak or reuse.

Automation with an audit trail. Every automated action (reading a document, sending a submission, publishing quotes, issuing a certificate) is recorded with its inputs, checks and outcome in an append-only log. Corrections are new entries, never edits.

What we will never do

Sell your data or hand it to lead buyers.
Send your information to a carrier you did not ask us to approach.
Hide that you are talking to software. The assistant says it is an AI, and a licensed agent is one step away.
Lock you in. Export and deletion are self-service.

Independence

CoverMatch runs on its own cloud accounts, database, email domain and phone numbers. It does not share customer data with any other system, including the agency's own systems. The only exchange is a yes/no check, using salted hashes, that stops the same business from being quoted twice.

Reporting a concern

Email the support address shown in the footer. Security reports are read by a person and acknowledged.

Questions people actually ask

Who at CoverMatch can see my documents?

Licensed staff handling an exception on your account, and only through an audited Desk view. Automated reading of documents happens without a person looking at them unless something needs review.

Do you share my data with carriers?

Only when you ask for quotes or a switch, and only with the carriers involved in that request. Nothing goes to a carrier you did not ask us to approach.

Where is the data stored?

In CoverMatch's own cloud accounts in the United States, in a database and private object storage that are not shared with any other company or system.

Can I take my data with me?

Yes. The account screen has a one-click export of everything we hold about your businesses, and an account closure that removes everything we are not legally required to keep as a licensed agency.