Security Policy

Benefits For You LLC treats employee enrollment data as confidential. This page describes the safeguards we apply to this portal. It is a summary of practices, not a warranty or certification.

• All traffic to and from this site is served over HTTPS/TLS.
• Enrollment records are stored in a managed cloud database provided by our hosting platform, with encryption applied by that provider.
• Uploaded documents such as employee handbooks are stored in private storage and served through short-lived, access-checked links rather than public URLs.

• Administrative areas require an authenticated account. Each agent or agency can only see the client groups they own.
• Database access is restricted by row-level security policies so an employee's record is reachable only through their own invite link or by an authorized administrator.
• Sensitive operations run on the server, never in the browser, and secrets and API keys are never exposed to client code.

Social Security numbers are collected only where a carrier requires them to issue coverage. They are transmitted to the carrier and are not displayed back in full anywhere in the portal.

We rely on reputable providers for hosting, database, storage, and CRM or messaging. Carrier enrollment platforms are operated independently and are governed by their own security and privacy programs.

• Access and error logs are reviewed for unusual activity.
• Automated checks verify that database and storage access policies remain correct after changes are deployed.
• Dependencies are updated as security fixes become available.

If we become aware of a security incident affecting enrollment data, we will investigate promptly, work to contain it, and notify affected employers and individuals as required by applicable law.

• Do not forward your personal enrollment invite link to anyone.
• Complete enrollment on a device you trust and sign out when finished.
• Be alert for phishing — we will never ask for a password by email or text.

If you believe you have found a vulnerability or noticed suspicious activity, please report it to your agent of record. Please do not publicly disclose the issue until it has been addressed, and do not access or modify data that is not yours while testing.