AES-256 at rest, TLS 1.3 in transit
Customer data is encrypted at rest and in transit. Connection-level: TLS 1.3 on every public endpoint. Storage-level: AES-256 inside the Postgres-backed primary datastore.
Compliance & Security
Built for the regulated industry
What we can defend, what we're working on, and where the operator's obligations begin. No claims we can't back.
Foundations
Security primitives
Row-level security on every table
Every authenticated record is gated by Supabase RLS at the database layer, not just the application. Service-role bypass is reserved for signed webhooks and cron-scoped jobs and is independently audited.
Edge-delivered, US-hosted
Application traffic terminates at Vercel's edge with native DDoS protection. The primary datastore is in a US region; backups are encrypted and geographically redundant within the US.
Scoped API keys, hashed at rest
Public-API and agent-integration keys carry per-tool scopes and a 32-char hash; the raw key is shown once and never stored. Per-request audit rows are written to a private analytics schema, not the public surface.
Compliance Posture
Current + roadmap
We don't advertise certifications we haven't earned. Roadmap items are listed honestly under their own column.
Defensible today
- TLS 1.3 enforced
- TCPA-aligned voice + SMS
- A2P 10DLC registered
- Licensed insurance producer (New Jersey)
On the roadmap
- Independent penetration test (planned 2026)
- SOC 2 Type II readiness assessment (planned 2026)
- State-by-state AI disclosure coverage as new statutes land
We'll update this page when audits complete; the date stamp at the bottom is the source of truth.
AI Governance
AI-assisted communications & state disclosure
The Compliance Engine sits underneath every step of the AI Final Expense Operating System: how LegacyCore uses AI in voice, SMS, and portal automation, and how it handles emerging state AI-disclosure laws.
Voice agents identify as AI
Within the call's opening seconds, LegacyCore's AI voice agent identifies itself as AI where applicable state law requires it. Texas TRAIGA-style disclosure is implemented; new state statutes are tracked and rolled into the script as they land.
Consent + DNC at the edge
Every outbound dial is filtered against the internal DNC list and the federal national DNC registry before the call is placed. STOP keywords on SMS revoke A2P consent immediately and propagate to the call queue.
Recording + audit trail
Voice calls are recorded and transcripts retained for compliance review, quality assurance, and dispute defense. Access is role-gated; deletion requests under applicable privacy law are honored consistent with the Privacy Policy.
Operator responsibility
Operators using LegacyCore are responsible for their own compliance with TCPA, state telemarketing statutes, and emerging AI-disclosure requirements. LegacyCore provides controls that support, but do not substitute for, that obligation.
Read the full posture
Operator obligations & disclosures
Operators using LegacyCore are responsible for ensuring their own use of AI-assisted communications complies with applicable federal and state law, including TCPA, state telemarketing statutes, and emerging AI-disclosure requirements. LegacyCore's technical controls support but do not substitute for the operator's ongoing legal obligations.
Privacy policy: /privacy.
AI communication disclosure
When AI is on the call
Communications with LegacyCore — including voice calls with prospective clients and post-sale conservation outreach — may be handled in whole or in part by AI-assisted voice agents and AI-drafted SMS or email content. Where required by applicable state law (including Texas TRAIGA, where applicable, and similar emerging state statutes), the AI agent identifies itself at the start of each call. Recipients may opt out of further AI-assisted contact at any time by replying STOP to SMS or by request during a voice call. Communications with AI agents may be recorded and transcribed for compliance, quality-assurance, and training purposes.
Insurance product disclosure
Producer and carrier dependent
Insurance products are offered exclusively through licensed insurance producers under their respective carrier appointments. Not all products are available in all states. Product availability, premium rates, underwriting standards, and acceptance are subject to each carrier's discretion and applicable state law. Carrier names appearing on LegacyCore properties identify the carriers licensed producers may be appointed with; their appearance does not imply endorsement or affiliation by the carrier beyond the producer's appointment.
Questions on a specific control?
For carrier compliance reviews, vendor security questionnaires, or operator due diligence, reach the team directly.