Security
Your information, handled properly
Applying for cover means telling us about your health, your finances and your household. Here is what happens to that information once you do.
In transit
Every page and every form on this site is served over TLS 1.2 or higher. The site refuses unencrypted connections and tells browsers to remember that.
At rest
Sensitive fields are encrypted in the database with AES-256-GCM. The encryption key is held outside the web root and is never present in a deployment package.
Passwords
Stored as Argon2id hashes with a per-account salt. We cannot read your password, and no member of staff can retrieve it — a reset is the only route back in.
Multi-factor sign-in
Time-based one-time codes can be switched on from your account settings and work with any standard authenticator app.
Step-up checks
Changing bank details, a beneficiary or an email address asks you to confirm your identity again, even in an active session.
Session handling
Sessions expire after a period of inactivity, cookies are flagged secure and HttpOnly, and signing out invalidates the session on our side, not only in your browser.
Audit trail
Every change to a record is written to an append-only log with the account, the action, the time and the address it came from.
Sign-in activity
You can see where and when your account has been accessed. Those records are purged automatically on a 30-day cycle.
Uploads
Documents you upload are stored outside the web root, served only through an authenticated handler, and cannot be executed as code.
What we ask of you
Most account compromises start outside the service that gets blamed for them. These four habits do more for your security than anything we can do at our end.
- Use a password you have not used anywhere else, and let a password manager remember it
- Turn on multi-factor sign-in — it is the single biggest improvement available to you
- Treat any message asking you to confirm bank details as suspect until you have called us on the number on this site
- Check your sign-in activity occasionally and tell us if anything looks unfamiliar
How we contact you
We will email you from info@equitableinsuranceservices.com and nowhere else. We will never ask for your password, a one-time code, or your full card number — not by email, not by text, and not on the phone. We will not send you a payment link out of the blue asking you to redirect a premium to a different account.
If something claiming to be from us does any of that, it is not from us. Forward it to info@equitableinsuranceservices.com and delete it.
Reporting a problem
If you believe you have found a security flaw in this site, please tell us at info@equitableinsuranceservices.com with enough detail to reproduce it. Please give us a reasonable period to investigate and fix it before publishing anything, and please do not access, alter or download data belonging to anyone else while testing. We will acknowledge your report and keep you updated.
Questions about your data?
Ask us directly. We will tell you what we hold, why we hold it and how long it stays.