Skip to main content
Security & data handling

Everything we hold,and every badge we haven't earned.

Koala reviews workers' compensation insurance premiums for employers. We rebuild the premium from the published rate tables, find the errors we can prove, and file the correction once you approve it. There is nothing to pay up front. We are paid a share of what comes back.

Doing that means reading your records. A review needs your payroll registers, your payroll tax filings, and the audit worksheet your carrier prepared. It also needs three years of loss runs: the carrier's record of every claim made against your policy, with injured employees named. That is a lot to send a company you have never met.

So this page is an inventory. What is encrypted, what gets logged, which outside companies see your records, and which security certifications we do not hold.

PROD

Security posture · enforced in the running app

4 live
  • PII-scrubbed logging

    PII means personal details: emails, addresses, phone numbers, policy numbers. They are stripped from every log line before it is written.

  • Encrypted in transit and at rest

    In transit means while it travels between you and us. At rest means while it sits in the database. Both are encrypted.

  • Payment data isolated

    Card details go straight to Stripe and never reach a Koala server.

  • Minimized by default

    Your browser is only ever sent a trimmed copy of your record, never the whole thing.

Independent and early-stage. Every line above runs in the live product today. What we have not built is further down this page, in the same detail.

The record, end to end

Every place a review record exists, and who can reach it.

Five sections. Each one names the thing it rests on: a piece of our code, an outside company, or, in one case, a certificate we do not hold.

01Ours

Your personal details never appear in our logs.

A log is the running diary an app writes as it works. Logs are a common place for sensitive data to leak, so nothing sensitive is written into ours.

Here is the failure this section is about. Something goes wrong, and the error message prints an employee's email or a policy number. That line then sits in a log file, readable, for as long as the logs are kept. Two layers stop it happening here.

First, by design. Document contents and your email address are never passed into a log message at all. When something fails, the code records the review ID and an error code. Nothing from the document goes with it. That is the primary guarantee.

Then, as a safety net. Every line the app writes goes through one piece of code that redacts personal details before the line is stored. It catches emails, US Social Security numbers, street addresses, ZIP codes, and phone numbers. It also catches policy and claim numbers, whether they are all digits or mixed, like POL-4432.

One gap stays open, and we would rather name it than leave you to find it. Names cannot be matched by pattern without redacting ordinary words along with them. So employee names are covered by the first rule, never log document contents, and not by the redactor. The redactor is a backstop. It is not the thing standing between your records and a log file.

PII

log redaction · fixed rules

Redacting

What a naive log might write

review POL-4432 for jane.doe@acme.com
at 42 Oak Street failed. Call
back on 555-238-9910

What Koala actually writes

review [id] for [email]
at [address] failed. Call
back on [number]

The redaction follows fixed rules, not a judgement call. The same input is always redacted the same way, so there is no AI model in the loop deciding whether your address counts as private.

02Ours

The controls around your data.

A control is a rule the software enforces, not a promise for later. Every row below runs in the code that handles your review today.

C-SERIES

Controls register · enforced in code

  • C-01

    Data minimization

    Your browser never receives your full review record. Every response is trimmed on our servers first: billing identifiers and internal fields are removed before anything is sent out.

  • C-02

    Payment isolation

    Card details go straight to Stripe and never touch Koala's servers. We store a reference number so a payment can be matched to an invoice. We never store a card number, expiry date, or security code.

  • C-03

    Access control

    Every review has a long random ID that cannot be guessed. Guessing it would not be enough anyway: opening a review also requires a signed access token, an HMAC-SHA256 signature issued to that review's owner. The internal dashboard our own team uses sits behind a separate gate, and its check takes the same time whether it passes or fails, so a wrong guess reveals nothing.

  • C-04

    Validated boundaries

    Software does the first read of your documents. Whatever an AI model returns is checked against a strict template before it is stored or shown to you, so a malformed answer cannot slip into your findings. Every finding is then reviewed internally, by hand, before it goes into a filing.

  • C-05

    Rate limiting

    We cap how many requests one internet address can make. No single caller can flood the system or run up cost against another client's review.

  • C-06

    Encryption everywhere

    Everything travels over HTTPS, so it is encrypted on the way to us and on the way back. Review records sit in a managed Postgres database (Supabase), encrypted while stored, with row-level security switched on: a database rule that stops an account reading rows that are not its own. Our keys and passwords are read from the server environment and are never committed to the code repository.

03Ours

The outside companies a review passes through.

A subprocessor is an outside company that handles part of your data on our behalf. Every one a review touches is named below, with what it sees. Each gets the slice its job needs and nothing more.

OFF-SITE

Subprocessor register · 6 vendors, and what each one sees

ProviderWhat it handles
SupabaseStores your review record in a managed database, encrypted while it sits there.
StripeProcesses payment of our invoices. Sees your card details so we do not have to.
Google (Gemini)Runs the AI models that read your payroll registers, audit worksheets and loss runs. They look for workers filed under the wrong class code, the category that sets the rate charged for them, and for errors in how the premium was rated. Doing that means the text of those records passes through the models.
ExaSearches the published rules a finding will cite: a rating manual rule, a class code definition, or a circular from the rating bureau, the body that publishes those codes and the rates for your state.
ResendDelivers your findings report and filing correspondence by email, if you give us an address.
UpstashCounts requests per internet address so the rate limits above can be enforced. It never sees the contents of a record.

One more path exists, and it only opens when you authorise a filing. The records behind that filing go to your carrier, to the rating bureau, or to the state insurance regulator. That is the filing itself, not a vendor arrangement, and it does not happen without your say-so.

We do not sell your payroll or claims data, and we do not train models on it. Our only income is a share of what a correction actually recovers for you. The full legal detail is in the Privacy Policy.

04Ours

We will not advertise a certificate we do not hold.

Plenty of early products decorate a security page with badges they never earned. That is worse than saying nothing, because it is a claim that fails the moment somebody checks it.

So, plainly: Koala is early-stage. We do not hold SOC 2, HIPAA, ISO 27001, or any other formal security certification today. Those are audits an outside firm performs and signs off on. No outside firm has audited us.

We have also not had an independent penetration test, where a security firm you hire attacks your live system on purpose to find the holes before somebody else does. When we earn any of this it will appear here with a date and a report behind it, and not one day before.

On the roadmap: not done yet

A commitment, not a credential.

  • SOC 2 Type II reportPlanned
  • HIPAA / ISO 27001 attestationPlanned
  • Independent third-party penetration testPlanned
  • Formal retention rules: how long we keep records, and when they goPlanned
  • A public bug-bounty program that pays outside researchersPlanned
05Yours

Found something? Tell us.

We do not pay bug bounties and there is no researcher portal. There is an address, and a person who reads it.

If you have found a way to reach records that are not yours, or a hole in anything claimed on this page, send it over. We will work with you to confirm it and close it.

Report a security issueInclude what you did and what you saw. We will tell you what we found, and when it is fixed.