Security You Can Trust
Insurance agencies handle sensitive client information every day — Social Security numbers, health details, banking information. simpleAMS decides access on the server rather than hiding it in the interface, and every change leaves a record.
Enterprise-Grade Security
Every simpleAMS deployment includes comprehensive security controls designed for the unique requirements of insurance agency operations.
Role-Based Access Control (RBAC)
Seven roles and 187 granular permissions, checked on the server on every request rather than hidden in the interface. Users only reach what they should — nothing more.
- Seven roles: Admin, Agency Owner, Executive, Corporate Staff, Manager, Agent, Contracting Specialist
- 187 permissions across every module and action
- Row-level visibility — managers see their team, agents see their own records
- Commission figures hidden from staff without the permission to see them
- Deactivated users lose access immediately
Two-Factor Authentication (2FA)
Add an extra layer of protection to every account. Optional two-factor authentication via email verification codes or authenticator apps like Google Authenticator. This ensures legitimate users can always access their accounts while keeping attackers out. Any user can enable it for their own account — they choose the method that works best for them.
- Email-based verification codes
- TOTP-based authenticator app support (Google Authenticator, Authy, etc.)
- Recovery codes for backup access
- Optional per-user — enable it if you want, skip it if you don't
- Easy setup and management
Comprehensive Audit Logging
Every action is recorded. Know who did what, when, and from where. Complete audit trails support compliance requirements and provide accountability across your organization.
- Every create, update and delete logged automatically
- Before and after values recorded on each change
- Logins, IP address and browser captured
- Searchable, with statistics and CSV export
Social Security Number Protection
Social Security numbers are encrypted at rest and masked on the server before they ever reach the browser. Only roles you have granted the View SSN permission see the full number — everyone else sees the last four digits.
- Encrypted at rest in the database
- Masked server-side, not hidden in the interface
- Full number gated behind an explicit View SSN permission
- HTTPS on every connection
- Applies to client, agent and employee records alike
Login Protection
Repeated failed sign-in attempts lock the account automatically, and bot protection sits on the login page itself. Administrators can deactivate any user and cut their access off at once.
- Automatic lockout after repeated failed attempts
- Bot protection on the sign-in page
- Two-factor challenge enforced before access is granted
- Deactivated users lose access immediately
- Login history recorded with IP address and browser
Dedicated Infrastructure
Each agency operates in its own dedicated environment. No shared databases, no resource contention — complete isolation for your data and operations.
- Isolated database per deployment
- Dedicated application instance on its own domain
- No shared tables, no cross-tenant exposure
- Built-in backup and integrity tools for administrators
Email Verification
Built-in email verification confirms user identities during account setup. An additional layer of trust before granting platform access ensures only legitimate users enter your system.
- Automatic verification email on account creation
- Verified status tracked per user
- Prevents unauthorized account activation
- Seamless onboarding experience
Force Password Change
Require users to set a new password on their first login. Every account starts with a secure, user-chosen credential — no shared or temporary passwords lingering in the system.
- Mandatory password reset on first login
- Ensures user-chosen secure credentials
- Eliminates shared or default password risks
- Available on dedicated agency deployments
Private Document Storage
Uploaded files sit outside any public web path. Every download runs through an authenticated route that re-checks the record and the permission before a single byte is sent — no guessable links, no public folders.
- Files stored off the public web root
- Every request re-checks record ownership and permission
- Inline preview without exposing a public URL
- Per-document access by role
- Upload and download activity recorded in the audit log
OAuth2 Email Integration
Connect Office 365 and Google email accounts using modern OAuth2 token-based authentication. No email passwords are ever stored in simpleAMS — just secure, revocable access tokens.
- Token-based authentication — no stored passwords
- Office 365 and Google Workspace support
- Revocable access tokens for complete control
- Automatic token refresh with no user disruption
Built for Regulatory Requirements
simpleAMS provides the tools and controls agencies need to meet compliance obligations and demonstrate accountability.
Data Privacy
Built with privacy principles in mind. Control over data collection, retention, and access.
Access Controls
Granular permissions ensure minimum necessary access for every user.
Audit Readiness
Complete audit logs and exportable reports for regulatory requirements.
Data Portability
Your data is yours. Export capabilities ensure you always have access.
Our Security Commitment
Security is not an afterthought at simpleAMS — it's foundational to everything we build. The platform is maintained and updated regularly, and because you talk directly to the person who writes the code, a security question gets a real answer rather than a ticket number. If your agency has specific requirements, let's discuss them.