Security & Data Handling

QuickAIProposal is a document-processing tool for licensed insurance agents, operated by beaconAI. This page describes how it handles data, who processes it, and what a corporate network needs to allow.

Last updated August 2026

For IT and security teams

Hostnames to allow (TCP/443, TLS 1.2+):

www.quickaiproposal.app quickaiproposal.app

There is no stable inbound IP to allowlist. The application is served from Vercel’s anycast edge network, which does not assign a fixed public ingress address, so this must be allowed by fully-qualified domain name in the proxy or secure web gateway rather than by IP.

If this domain is being isolated or blocked on your network, it is a URL categorisation matter rather than a content or malware finding — the site is a standard business SaaS application. We are happy to answer a security questionnaire; contact details are at the foot of this page.

What data the product handles

Agents upload insurance quote documents and, optionally, a prospective customer’s current carrier declaration pages. These documents can contain nonpublic personal information (NPI) about the agent’s customer — names, addresses, vehicle details, coverage limits and premiums. The product extracts the figures needed to build a comparison proposal.

Agents are responsible for handling their customers’ NPI in line with their own obligations, including the Gramm-Leach-Bliley Act and applicable state insurance data-security law. This page is intended to support that diligence, not replace it.

How data flows

The agent’s browser uploads documents over TLS to the application.
Documents are held in memory for the duration of the request and sent to the Anthropic Claude API for extraction. They are not written to disk, object storage or a database by this application.
Extracted figures are returned to the agent’s browser, where the proposal is assembled and reviewed.
The agent copies or downloads the finished proposal and sends it to their customer themselves. The product does not email proposals to customers.

What is stored, and for how long

Data	Where	Retention
Agent account — name, email, agency, contact details set in the profile	Supabase (PostgreSQL, US)	Life of the account
Quote activity counters — a timestamp and quote type per proposal, containing no customer information	Vercel KV	400 days
Billing — subscription status and Stripe customer reference	Supabase / Stripe	Life of the account
Uploaded documents and extracted customer details	Not stored	Held in memory for the request only

Customer names, addresses and policy details are not written to our database or our counters. See the Privacy Policy for the full statement and for deletion requests.

Subprocessors

Provider	Purpose	Trust information
Vercel	Application hosting and edge delivery	security.vercel.com
Supabase	Authentication and PostgreSQL database	supabase.com/security
Anthropic	Claude API — document data extraction and copy generation	trust.anthropic.com
Stripe	Subscription billing and payment processing	stripe.com/docs/security
SmashSend	Transactional and lifecycle email	smashsend.com

Document contents are sent to Anthropic solely to perform the extraction the agent requested. Per Anthropic’s commercial terms, inputs and outputs submitted through their API are not used to train their models by default.

Application security

All traffic is served over HTTPS. HTTP Strict Transport Security is enabled with preload.
Authentication is email and password via Supabase Auth, with server-validated sessions. Every API route verifies the session before accessing data.
Database access is constrained by row-level security policies, so an agent’s session can only read that agent’s own records. Privilege-bearing columns are not writable by an end-user session.
Document-processing endpoints are rate limited per account.
Secrets are held in the hosting platform’s encrypted environment configuration, never in source control. Commits and pushes are scanned automatically for credentials.
Data is encrypted in transit (TLS 1.2+) and at rest by the underlying platforms.

Compliance posture

Stated plainly, because a vague answer is worse than a candid one:

beaconAI does not hold a SOC 2 report today.
Multi-factor authentication is not yet available for agent accounts.
Our infrastructure providers hold their own certifications; see the trust links above.

If your organisation requires a security questionnaire, a data-processing agreement, or evidence beyond this page, please get in touch and we will work through it.

Reporting a vulnerability

Email dale@beaconai.ai with “Security” in the subject. We aim to acknowledge within two business days. Please give us a reasonable window to remediate before public disclosure. We will not pursue action against good-faith research that avoids privacy violations and service disruption.

Contact

beaconAI — beaconai.ai
dale@beaconai.ai

QuickAIProposal is an independent product of beaconAI. It is not affiliated with, authorized by, endorsed by, or sponsored by American Family Insurance. "American Family" and "AmFam" are trademarks of American Family Mutual Insurance Company, S.I.

Home · Privacy · Terms