Security
Security Built for
Commission Data
Commission data is producer pay, carrier relationships, and agency revenue. CommissionScope protects it with encryption, separate agency data, Microsoft work-account sign-in, a second factor when the agency requires one, role-based access, and an audit trail. This page also says plainly which third-party attestations CommissionScope does not hold yet.
Controls in CommissionScope today
Each control below is in the product now. Where a control depends on the deployed environment, the sentence says what evidence we share and when.
Encryption in transit and at rest
Traffic between your browser and CommissionScope uses TLS. Sensitive fields such as bank details are encrypted in the application. CommissionScope does not claim that every stored file or every backup location is certified encrypted.
Each agency sees only its own data
One agency cannot open another agency’s statements, policies, or payouts. Staff access for support is limited and logged.
Multi-factor and passwordless sign-in
Sign-in is email and password, a Microsoft work account, Google, or a magic link. Accounts can require a second factor. A Microsoft sign-in matches an existing CommissionScope user. It does not create an account, and personal Microsoft accounts such as Outlook.com are not accepted.
Role-based access
Roles decide who can upload statements, match policies, approve calculations, create payouts, and change agency settings. Producers see only what the agency grants.
Audit log of changes and approvals
Uploads, matches, corrections, calculations, approvals, and payout exports are logged with the user and timestamp. The audit trail is part of every payout batch’s evidence.
Payment safeguards
Live ACH and NACHA transmission is disabled by design; CommissionScope never moves money. Changes to a producer’s bank details wait 72 hours before they take effect.
Secure development
Every change is code-reviewed. Dependency vulnerability checks and secret scanning run on the repository. Releases are gated by tests that one agency cannot read another’s statements, and by tests of the commission math.
Backup and restore procedures
CommissionScope runs in the AWS US East (N. Virginia) region, and the database server that holds commission records sits in a private network with no public internet address. The server is backed up daily. Daily backups are kept 7 days, weekly backups 5 weeks, and monthly backups 3 months. Restore evidence is shared with pilot customers on request.
What we do not claim yet
Security pages often imply certifications they do not hold. These four are on the CommissionScope roadmap and are discussed openly with every pilot customer. None of them is claimed today.
SOC 2 report
CommissionScope has not completed a SOC 2 audit. The controls above are designed with that audit in mind, and we walk pilot customers through them directly.
ISO 27001 certification
No ISO certification is claimed. We will say so until an independent certification body has issued one.
Published penetration test
No third-party penetration test report is published yet. Pilot agreements can include a customer-led assessment of the pilot environment.
Availability commitments
Availability and recovery targets are set in a signed order form, not advertised. Health checks and monitoring exist; a contractual service-level agreement is agreed per customer.
Questions for your security review
The questions IT reviewers and controllers ask most, with the answer CommissionScope gives. Bring the rest to a security review and we answer in writing.
- 01 —
Where is our data stored and who can reach it?
With the agency that owns it. Another agency cannot open those records. Port & Starboard staff access is limited to support work and is logged.
- 02 —
Do carrier statements train a shared model?
Approved corrections are stored per agency. They are not shared with another agency, and they do not auto-accept a policy match.
- 03 —
Can CommissionScope move money?
No. Live ACH and NACHA transmission is disabled by design. Payouts leave as CSV and PDF for your own payroll or check process.
- 04 —
How do we get our data out?
Commission and payout data export as CSV at any time. Full account exports and deletion are handled by support during the pilot program.
- 05 —
What happens during an incident?
Detection, containment, customer communication, and recovery follow a written runbook. Named contacts and notification timing are set in your agreement.
Privacy requests
During the pilot program, Port & Starboard support handles data export, deletion, and consent requests for CommissionScope accounts. Audited self-service privacy controls are being rebuilt and will replace the support path when they are ready.
Report a vulnerability
If you find a security issue in CommissionScope, tell us before you tell anyone else. Use the security contact and we will acknowledge the report, keep you informed, and credit you if you want credit.
Proof the controls produce
Security here is not a badge. It is a statement normalized for matching, a split that had to balance, an approval that a named person gave, and a payout PDF with the audit trail behind it. Shown with synthetic data.
Synthetic demo data
- Upload
PDF/CSV
- Review
12 lines
- Match
10 auto
- Calculate
$1,367.95
- Approve
2 queued
safeco_apr_2026.pdf
Carrier statement normalized for policy matching
02166046
Harbor Glassworks
Match evidence
2166046 normalized
Producer split
$420.00
PRG-EVT-00251
Northshore Marine Supply
Match evidence
Producer + policy
Producer split
$615.20
SFE/EVT-00107
Bayfront Bakery
Match evidence
Carrier format
Producer split
$332.75
| Policy | Insured | Match evidence | Producer split |
|---|---|---|---|
| 02166046 | Harbor Glassworks | 2166046 normalized | $420.00 |
| PRG-EVT-00251 | Northshore Marine Supply | Producer + policy | $615.20 |
| SFE/EVT-00107 | Bayfront Bakery | Carrier format | $332.75 |
Bring Your Security Questions
Start a security review and we answer in writing, or request a demo and see the controls in the product. Either way, you hear what is in place and what is still on the roadmap.