Security

Built to be checked, not trusted.

An agency carries the errors-and-omissions exposure for everything sent in its name. So every operation starts held, every run leaves a record, and nothing depends on taking our word for it.

See review mode

What stands between a request and a carrier.

Eight safeguards. Each one is a rule you can read and a record you can pull, not a promise.

Ask for the security packet
Review mode

Every operation starts held, carrier by carrier. Nothing is sent until a person has approved 25 runs in a row, and one rejection resets the count.

25 approvals in a row

Held runs

A new holder, wording the policy does not support, a limit above the policy or a renewal that moves over 10% waits for a named person. It is never sent on a timer.

No timeouts

Credential vault

Carrier logins are encrypted one by one, never displayed again to you or to us, and used only for operations you have switched on.

AES-256, a key per credential

Audit log

Each run records what was read, what was sent, who approved the operation and when. Entries cannot be edited or deleted.

Kept 7 years

AMS access

Read-only for the first two weeks. Write access is granted one operation at a time and can be withdrawn in a click.

Read-only first

Sign-in and roles

Single sign-on and two-factor on every account, with roles that separate preparing a run from approving it.

SSO + 2FA required

Where data lives

Policy data is stored in two US regions, encrypted at rest and in transit, and is never used to train a model.

US regions only

Outside audit

An independent firm audits our controls every spring. The report is yours to read under NDA before you sign anything.

SOC 2 Type II

Every run leaves a record a carrier would accept.

What Bevel read, what it sent, who approved the operation and when. The log cannot be edited or deleted, by you or by us, and it exports as one file for an E&O claim or a carrier review.

  • One entry per step, stamped to the second in Central time
  • Held and rejected runs are logged with the reason a person gave
  • Kept for seven years, exportable as PDF and CSV at any time

Audit log

GL-20481-07 · Harlan Builders · Sep 8, 2026

  1. 9:41:07 AM

    Email received

    j.medina@harlanbuilders.example

    Read

  2. 9:41:09 AM

    Policy matched

    GL-20481-07 · Heartland Assurance

    Matched

  3. 9:41:22 AM

    Wording checked

    Additional insured · CG 20 10 on file

    Passed

  4. 9:41:31 AM

    Certificate prepared

    ACORD 25 · 1 page · e-signed

    Prepared

  5. 9:41:58 AM

    Sent to holder

    City of Ankeny, Permits Desk

    Sent

  6. 9:42:00 AM

    Filed to account

    Certificate and source email

    Filed

6 entries · operation approved for hands-off by M. Ostrowski on Mar 3

Questions a principal asks first

The security packet has the SOC 2 report, our own certificates of insurance and the data-processing terms.

Ask for the security packet
Can Bevel staff see our clients’ policy data?

Only the engineer repairing a connection for your agency, only for the run in question, and every such access is written to your audit log with their name. Nobody browses.

What happens to a carrier login when someone leaves our agency?

Bevel uses its own portal user wherever the carrier allows one, so staff changes do not touch it. Where it shares a login, changing the password in the vault takes effect on the next run.

What if Bevel issues something it should not have?

The audit log shows what it read and why the run was not held, and the operation drops back to review mode for that carrier. In eight months no certificate has needed correcting after the fact.

Do you carry your own E&O and cyber coverage?

Yes: $5,000,000 in technology errors and omissions and $5,000,000 in cyber liability. Certificates for both are in the security packet, issued by Bevel itself.

Can we get our data out?

At any time. The audit log and every document Bevel filed export as PDF and CSV, and stay downloadable for 90 days after an account closes.

Check it yourself for two weeks.

Connect the AMS read-only and approve every run by hand. The audit log is yours from the first one.

Start routing Book a 20-minute walkthrough
Sheet
1 of 1
Revision
Sep 2026
Drawn by
Bevel
Checked by
A person, every time