Trust
The most useful security control here is what we never receive
PropertyRiskIQ takes a property address and returns public and licensed reference data about it. It is architected so that your book, your policyholders and your loss experience stay in your systems.
Data boundary
What crosses the line, and what does not
What PropertyRiskIQ receives
- The property address you look up
- The account details of the person doing the lookup
- Notes your team writes on a case
What it never receives
- Your policy administration data or your in-force book
- Claims and loss history
- Your rates, rating factors or pricing models
- Applicant or policyholder personal data beyond the address itself
- Any bulk upload of your portfolio
Address lookups do return public record data about the property, including owner name and mortgage information where the licensed source carries it. That is property data rather than your customer data, but it is still personal information about a real household and should be handled accordingly by everyone with access to the file.
Controls
How the system is operated today
Provider credentials
Data provider API keys are held as server-side environment variables and are used only from the server. No provider key is ever sent to the browser, and no provider is called directly from a client.
Transport
The site and the application are served over TLS. Provider calls are made server to server over HTTPS.
Access
The application is gated. Demo access is issued deliberately rather than left open, which also keeps metered provider spend under control.
Retained responses
Raw provider responses are retained against the analysis so a figure can be traced back to its source. That retention is the audit feature, and it is scoped to the properties you looked up.
Simulated data is labelled
Where a layer has no live source, the product marks the values as simulated in the interface rather than presenting them as sourced. The crime layer is currently in that state.
Hosting
Hosted on Vercel's managed platform. We do not run our own servers, and there is no self-managed database holding customer data at this stage.
Certifications
Where we actually stand
Vendor risk teams get told what they want to hear often enough. Here is the accurate version.
SOC 2
Not certified. No Type I or Type II report exists. A SOC 2 program is planned for the point at which the product holds customer data that would warrant one, which by design it does not today.
ISO 27001
Not certified.
Penetration test
No third party penetration test has been performed yet.
Data processing agreement
Available on request for a design partner engagement, scoped to the limited data described above.
Subprocessors
Vercel for hosting. ATTOM Data Solutions and Google for data retrieval. A current list is provided on request during an engagement.
If you have found a security issue, please write to hello@propertyriskiq.com with enough detail to reproduce it. We will acknowledge within two business days.