Security
The first question every agency asks: 'What are you doing with my data?' Here's exactly what we do, and what we don't.
Carrier compliance
Security is about protecting your data. Carrier compliance is about making sure carriers never have a reason to flag us. Both matter. Here is how we handle the second part.
Nothing submits to a carrier portal without your team's review. Relay drafts the submission, surfaces it in the portal UI with an explicit approval step, and waits for your agent to press approve. Every run generates an audit trail with timestamps and the reviewing agent's name, so you can prove the human chain of custody at any time.
Relay runs inside your own portal sessions using credentials you provision and control. There are no shared Relay accounts, no API scraping, and no back-channel access to carrier systems. Credentials are stored in an encrypted vault (AES-256, SOC 2 practices in progress) and you can revoke any carrier at any time with a single click.
We throttle submissions per carrier based on historical agency baselines, so carriers see the same kind of traffic pattern a working team would generate. Rate limits are configured per-carrier and tuned over time. Relay never fires hundreds of concurrent submissions at a single portal, which is the behavior that gets real agencies flagged.
Configured Preview workflows are monitored for portal changes. When a change affects the workflow, Relay stops the affected work and returns it for review until the workflow has been updated and validated.
Credential storage
All carrier portal credentials are encrypted at rest using AES-256, the same standard used by banks and government agencies.
Your credentials are accessed only by our automation system. No Relay employee can view or retrieve your passwords.
Credentials are stored in an isolated vault with access logging. Every access is audited and traceable.
MFA handling
Many carrier portals require MFA. Our system handles MFA prompts programmatically where supported, and coordinates with your team for portals that require manual MFA approval. We never store MFA tokens beyond their valid session window.
Client data handling
All data is encrypted in transit using TLS 1.2+. No client data is ever transmitted in plaintext.
Client data processed during automation runs is encrypted at rest and retained only as long as needed to complete the workflow.
We only access the data fields required for your specific automation workflows. No bulk data extraction, no data mining.
When you offboard, all your data (credentials, client records, workflow configurations) is permanently deleted within 30 days.
Compliance
We follow SOC 2 Type II security practices across our infrastructure, access controls, and monitoring.
For agencies handling health insurance, we maintain HIPAA-aware data handling practices.
We're built to support compliance with state-level insurance data handling requirements.
Our security practices are regularly reviewed and updated to address emerging threats.
We carry comprehensive cyber liability insurance. Documentation available upon request.
Due diligence
If you're evaluating any automation vendor, including us, ask these questions:
Let’s talk.
FAQ
No. Credentials are encrypted and accessed only by the automation system. No human can view them.
We have an incident response plan that includes immediate credential rotation, client notification within 24 hours, and full forensic investigation.
Never. Your data is yours. We don't sell, share, or use it for anything other than running your automations.
We monitor portals continuously. When changes occur, we update automations and re-validate security configurations.
We follow SOC 2 Type II practices and maintain comprehensive security documentation available upon request.
Yes. Contact us at hello@relayins.com and we'll share our security overview and practices documentation.
No automation can guarantee a carrier will never challenge or lock a session. Relay uses agency-controlled sessions and configured rate limits, and we validate each Preview workflow with the agency. Agencies remain responsible for their carrier agreements and access policies.
No. Relay does not scrape. It uses authenticated sessions in the same portal UIs your team uses, driven by a human-in-the-loop approval step. Nothing submits without your agent reviewing it first.
Configured Preview workflows are monitored for changes. If a change affects the workflow, Relay holds the work for review until the workflow is updated and validated again.
Get started
Spring ’26 is full. Get on the Summer ’26 list and we will be in touch as spots open.