Trust
Security and data handling.
Proposal Wolf handles quotes and client contact details for independent insurance agencies. This page says what we store, where it lives, who can see it, and when it goes away. The privacy policy covers the same ground in policy terms; this is the technical version.
What a proposal stores
A proposal record holds what the proposal shows: client and business names, contact details, the quote numbers and dates, coverage lines with their limits and premiums, and the payment schedule as the carrier stated it. Activity lands on the same record: sent, viewed, questions asked, and an acceptance with a typed name.
What the schema has no place for
There is no column for a Social Security number, a driver's license number, a date of birth, or a bank or card number. The payment fields hold the carrier's billing schedule, never payment credentials. A category of data the database cannot hold is a category we cannot leak, and we intend to keep it that way.
Client links
Every client link is an unguessable token: 24 bytes from a cryptographic random source, which is 192 bits, never a sequential ID. A link grants read access to that one proposal and nothing else. There is no client login and no client account. If the agency attached the carrier quote and turned on client download for that proposal, the same link can download that one file; that switch is off by default.
Staff access
Staff routes require a signed-in session, and admin routes require the admin role; both are enforced server-side on pages and API handlers. Passwords are stored as hashes. An agency can start a trial at /signup. Team accounts are created by an agency admin or a Shoot the Moon owner, so every extra seat traces to a person who vouched for it.
One agency cannot see another
Every proposal row, settings row, and staff account is stamped with its agency. Queries are scoped to the signed-in user's agency at the data layer, so an agency's pipeline, brand settings, and team are visible to that agency alone.
Carrier quote files
When an agency uploads a carrier quote PDF, the file is stored against that one proposal. It is deleted 90 days after it is stored, or sooner if the agency removes it; an upload that never attaches to a proposal is gone within 24 hours. Expired files stop being served immediately.
The AI import
The optional import sends the uploaded quote document to Anthropic's API to pre-fill the review form. Fields the document does not state come back blank, never guessed, and nothing reaches a client until a person at the agency reviews every line and sends it. Paste-in import works the same way. Skipping the import entirely and typing the form by hand is always available.
Proposal and notification email goes out through Resend under the agency's name, with replies addressed to the agency. The record is written before any send is attempted, so a failed email never loses the proposal or the lead; failures are recorded, not swallowed.
Infrastructure
The product runs on Vercel and stores records in a managed Postgres database. All traffic is served over HTTPS with strict transport security. Every response sends X-Frame-Options DENY and Content-Security-Policy frame-ancestors 'none', so no page can be framed. A report-only Content-Security-Policy names the third-party hosts each surface may load. The Meta pixel host is allowed on marketing and landing pages only, never on a client proposal link. Secrets live in server-side environment variables and are never shipped to the browser.
What we do not do
We do not sell proposal data. We do not share it with carriers. Marketing pages do not set tracking cookies. Page analytics are aggregate counts, not profiles.
Report a concern
Found something? Tell us at hello@proposalwolf.com and we will respond. Good-faith reports are welcome.