Security

The strongest protection for a piece of information is not holding it. Loan documents are never stored. A borrower's loan paperwork reaching ReferBound by any route — forwarded email, agent upload, or partner upload — is read once in memory and discarded rather than written to disk.

What we keep from it is what a quote requires: names, dates of birth, contact details, property address, closing date, and loan number. Our AI provider is instructed not to return Social Security numbers, income figures, asset balances, or account numbers, and none of those are written to our database.

We also never store carrier-proprietary rating data, and we never ask an agent for carrier credentials.

Application data is held in Postgres on Supabase, and documents in a private storage bucket that is not publicly listable. Both are encrypted at rest by the provider, and all traffic to and from ReferBound is over TLS.

Our application never reaches the database with a public key. Every query runs server-side through a service credential, and row-level security is enabled on every table so that anonymous and end-user keys can read nothing at all.

Agents see only their own account's referrals, partners, and documents. Team members on an Agency plan share the account owner's data by design; that is the point of a shared agency board.

Partners reach their portal through an unguessable link. That link shows only the clients that partner referred — never another partner's clients, never the agent's wider book. Agent-issued documents on a deal appear only once the policy is bound.

Clients who are emailed their own documents receive a link signed for that single document with an expiry. They are never given a partner's portal token.

A magic link is a key. If a partner's link is ever shared beyond who should have it, the agent can rotate it from the partner's page, which invalidates the old one immediately.

An agent may be issued a private forwarding address. It is unguessable, belongs to one account, and mail sent to it is processed only for that account.

Incoming webhooks are rejected unless they carry a valid signature from our mail provider and a recent timestamp, so an unsigned or replayed request cannot create a referral. Mail from a sender we cannot match to one of that agent's existing partners is held for review rather than acted on, and we never send an automatic reply to an unrecognized address.

Where a sender's mail system encrypts a message end-to-end, we cannot decrypt it and do not attempt to. Only unencrypted parts, such as the subject line, are processed.

AI is used to read documents and messages and to draft text a person then reviews. It is never used to decide coverage, price a policy, or send anything on its own.

Documents and message content are sent to Anthropic's API for extraction. That content is not used to train models. Every prompt treats the content as data rather than instructions, so text inside a document or email cannot direct the system to do something it otherwise wouldn't.

Anything drafted for a client or a referral partner is shown to the agent for editing before it can be sent. Nothing customer-facing is ever sent automatically.

Texts go only to contacts who have opted in, and consent is recorded against the phone number it was given for. Changing the number clears the consent. Every message carries opt-out instructions, and STOP is honored immediately. Consent does not transfer between agents: if a partner's setup is shared with another agent, the SMS opt-in does not come with it.

Agents choose how long uploaded source documents are kept — indefinitely, or purged after 30, 90, or 180 days. Details already extracted onto a referral survive the purge; the file does not. Loan documents are exempt from this choice because they are never stored in the first place.

Agents can export everything as CSV at any time, delete individual referrals and documents, and delete their account, which removes their data.

ReferBound is a small product built by a small team. We are not SOC 2 certified, we do not hold ISO 27001, and we have not undergone a third-party penetration test. We would rather say that plainly than imply otherwise.

What we do claim is specific: no data selling, no advertising trackers, no carrier credentials, no loan documents on disk, and no automated messages to your clients.

If you believe you've found a vulnerability or a data-handling issue, email hello@stonebind.com. Please include enough detail to reproduce it. We'll acknowledge and tell you what we're doing about it; we won't pursue anyone who reports something in good faith.