Security

What we protect

The platform holds case details, onboarding progress, documents, and open items with named owners. The public site is separate: it does not host customer files or claims. Security controls scale to the system that actually stores program data.

Access

Client platforms are limited to people the organization authorizes. We use unique user access, not shared inboxes, as the default. Cascovia staff reach production data only when needed to operate or support a program, and that access is reviewed.

Infrastructure

Application and file storage run on reputable cloud providers with encryption in transit (TLS) and encryption at rest. Backups follow the same encryption standard. We keep production systems patched and monitor for unusual access.

Vendors and partners

Carriers, banks, lenders, and other partners stay in the client’s bench. We send them only what the program needs to move, through the channels the client already uses where possible. Subprocessors that host Cascovia itself are bound by contract to protect the data.

Application practice

We design the product so the next action stays attached to a named owner instead of living in forwarded attachments. That reduces stray copies of sensitive files. We do not post platform contents on the marketing site. Product shots on this site are illustrative, not live client data.

Incident response

If we become aware of unauthorized access to client data, we investigate, contain the issue, and notify the affected organization as required by the services agreement and applicable law.

Your role

Clients should grant platform access only to people who need it, remove users who leave, and avoid placing full SSNs or unnecessary clinical or financial detail in free-text fields when a lesser identifier will do.

Questions

Security questions and reports: use the contact form.