Security and privacy
A quote in this platform starts with a medication list and a condition history, and ends with a Medicare beneficiary identifier on a signed application. Everything here follows from that.
Where the program stands
An honest position is more useful to a compliance officer than a badge, so here is ours.
Solved Enroll handles protected health information and Medicare beneficiary data as a matter of course. Medications, conditions, prescribing history, plan elections, and beneficiary identifiers all live in the client record, because that is what it takes to quote a formulary accurately and pre-qualify a life case before submission.
We operate a documented security and HIPAA program with administrative, physical, and technical safeguards, and formal audit readiness work is underway ahead of general availability. We do not hold a completed SOC 2 report or a third-party HIPAA attestation today, and we are not going to imply one. This page describes the controls that are in place and the program that governs them.
Solved Enroll is in private beta. Agencies are onboarded in cohorts ahead of a 2027 public rollout, and security review is part of onboarding each one. Join the waitlist for the next cohort.
Security controls
Six control families, each one shaped by the fact that the data is regulated rather than merely sensitive.
Encryption in transit and at rest
TLS 1.2 or higher for every connection, including API and MCP traffic. Client records, health profiles, quotes, applications, and signed documents are encrypted at rest with AES-256. Keys are managed by the platform and rotated on a schedule.
Access tied to appointment and licensure
Roles are least-privilege by default, and what an agent can quote or submit follows the licenses and carrier appointments recorded for them. An agent cannot open a case for a product they are not appointed to write.
Hierarchy-scoped visibility
Visibility follows your upline and downline structure rather than a flat user list. A principal sees their downline, a manager sees their team, and an agent sees their own book. Changing the hierarchy changes visibility immediately.
Audit logging on every case action
Scope of Appointment, disclosures, intake edits, quotes run, plans presented, recommendations, signatures, submissions, exports, and document views are all written to the case record with who did it and when.
Minimum necessary by default
Health data is collected because a carrier rule or a formulary lookup needs it, and the intake stops asking once the remaining carriers no longer need the answer. Medicare numbers and Social Security numbers are masked in the interface and in exports.
Credential handling for API and MCP
Bearer tokens are scoped to one account, issued per integration, revocable individually, and rotatable without downtime. Tokens are shown once at creation and stored hashed. Webhook deliveries are signed so a receiver can verify origin.
The two kinds of data this platform cannot avoid
Health information drives underwriting and drug pricing. Beneficiary identifiers drive eligibility and enrollment. Both are handled as regulated data by default.
Protected health information
- Medications, conditions, dates, and severity are collected because a carrier rule or a formulary lookup needs them, and the questions stop when the remaining carriers stop needing answers.
- Health profiles are scoped to the case and the hierarchy above it, never browsable across an agency.
- Every view, edit, and export of a health profile is logged with attribution and a timestamp.
- Profiles age out on the retention schedule configured for the products quoted from them.
Medicare beneficiary data
- Beneficiary identifiers and Social Security numbers are masked in the interface and in exports, and revealed only where a submission requires the full value.
- Eligibility and enrollment-history lookups are recorded on the case, so the basis for quoting a given election period is reconstructable.
- Scope of Appointment is captured and timestamped before the sales conversation, and stored with the case rather than in a separate system.
- Enrollment records are retained for the period the carrier and the state of sale require, then aged out on schedule.
What the audit trail records
The trail is a by-product of the workflow rather than something an agent has to remember to produce. Every row below carries the actor and the timestamp.
| Scope of Appointment | The SOA form, the products it covers, the capture method, the client acknowledgement, and the timestamp, recorded before the sales conversation begins. |
|---|---|
| Disclosures | Which required disclosure was presented, at what point in the workflow, and the client acknowledgement against it. |
| Intake and health data | Every addition, edit, and removal of a medication, condition, or client detail, with the agent who made it and the time. |
| Quotes and exclusions | The quote run, the rule set version it ran against, the plans returned, and the reason every excluded plan was filtered out. |
| Recommendations | The ranking, the score, the weighting in effect, and the factors that lifted or lowered each plan. |
| Signature | Delivery method, device, IP address, consent text, partial saves, and the completed signature, retained with the document. |
| Submission | The submission attempt, the carrier reference, acknowledgement, requirements raised, and final disposition. |
| Access and export | Document views, downloads, case file exports, scheduled export runs, and API reads, attributed to the user or the token that made them. |
A complete case file, containing all of the above in order, exports as a single document. See responding to a carrier or CMS review for what that export contains.
Minimum necessary, then scheduled aging
Two obligations pull in opposite directions: keep records long enough for a carrier or a reviewer, and do not keep health data longer than you need it. Retention windows are configured rather than assumed.
- Configured per carrier and per state. Retention is set to the longest applicable requirement for the products you write and the states you write them in, not to one global default.
- Aging runs on a schedule. When a window closes, the record is aged out automatically. Nobody has to remember to clean up a book of business.
- Collection is bounded. Intake asks for a condition detail because a live carrier rule turns on it. When no remaining carrier needs it, it is not asked.
- Legal hold is explicit. A record under review or dispute is held past its window deliberately, with the reason recorded, rather than silently.
| Enrollment and application records | Held for the period the carrier and the state of sale require, configured per carrier and per state rather than set globally, then aged out automatically once the window closes. |
|---|---|
| Scope of Appointment records | Retained with the case for the full recordkeeping period that applies to Medicare marketing and enrollment activity, and exportable as part of the case file at any point inside it. |
| Health profiles | Retained while a case is active and for the retention window that applies to the products quoted from it. Profiles no longer supporting a case are aged out on the same schedule. |
| Quote and recommendation history | Retained so a past recommendation can be reconstructed against the rule set and plan year that produced it, then aged out with the case. |
| Audit log | Retained at least as long as the records it describes, because an audit trail that outlives nothing is not an audit trail. |
| Exports and API reads | Export files are held for a short collection window and then deleted. The record that an export happened, and who ran it, is kept with the audit log. |
Vendors, subprocessors, and credentials
The platform depends on other services. Two of them touch regulated data, which is why they are reviewed rather than simply chosen.
Subprocessor and vendor review
Any vendor that stores, transmits, or processes client data is reviewed before it is used and re-reviewed on a cycle.
- Review covers data residency, encryption, access control, breach notification terms, and whether a Business Associate Agreement is required.
- A vendor that would process PHI without an appropriate agreement in place does not get used for that purpose.
- The subprocessor list is maintained internally and shared with agencies during onboarding on request.
- Card payments are handled by a payment processor rather than stored on our systems.
Secure credential handling
API and MCP access is credentialed per integration, so revoking one does not break the others.
- Bearer tokens are scoped to one account and one integration, shown once at creation, and stored hashed.
- Rotation issues a new token alongside the old one so a cutover does not require downtime, then revokes the old one.
- Token reads inherit the permissions of the account they belong to, including hierarchy scope, so a token cannot see more than its owner.
- Webhook deliveries are signed and timestamped so a receiver can verify origin and reject replays. See the webhooks reference.
Incident response and breach notification
A documented process, run the same way every time, so the first hour is not spent deciding who does what.
-
Detect and declare
Anyone inside the company, and any agency or researcher outside it, can raise an incident. Raising one is deliberately cheap, because the expensive failure is a report that nobody escalated. Declaring an incident assigns an owner immediately.
-
Contain
Stop the exposure before explaining it. Credentials are revoked, access is cut, and affected components are isolated. Containment actions are recorded as they happen so the timeline is not reconstructed from memory afterward.
-
Assess scope and data involved
Determine which records were reachable, which were actually accessed, whether protected health information or beneficiary identifiers were involved, and which agencies and clients are affected. The audit trail is the primary evidence for this, which is one reason it covers document views and exports.
-
Notify
Affected agencies are notified without unreasonable delay, with what happened, what data was involved, what we have done, and what they should do. Where an incident is a reportable breach of protected health information, notification follows the HIPAA breach notification requirements and any applicable state law, including notice to individuals and regulators where required.
-
Remediate and write it up
Fix the cause, not the symptom, then publish an internal post-incident review with the timeline, the root cause, and the control changes that follow from it. Platform-wide incidents also appear on the status page, and beta cohorts get the notice directly.
Compliance program
Four bodies of rules apply to this platform at once. The program treats them as one operating requirement rather than four separate projects.
HIPAA program
Administrative, physical, and technical safeguards for protected health information, with named internal ownership, documented policies, workforce training, risk assessment, and a breach notification process. We will enter into a Business Associate Agreement where HIPAA requires one, and that review is part of onboarding an agency. Formal audit readiness work is underway; there is no completed attestation today.
CMS marketing and enrollment requirements
The workflow is built so that required disclosures are presented at the point in the conversation the rules call for, the plans presented and the plan chosen are recorded, and the enrollment record shows the basis for the election period used. Because plan data and rules are versioned by plan year, a case from a prior year can be reviewed against the rules that were in force when it was written.
Scope of Appointment recordkeeping
SOA is captured before the sales conversation, tied to the products it covers, timestamped, and stored on the client record rather than in a folder somewhere. It travels with the case file export, so producing it for a carrier or a reviewer does not mean searching three systems. Missing or expired SOA is surfaced as a blocker rather than discovered later.
State privacy and insurance law
State privacy laws and state insurance department recordkeeping rules vary, so retention windows, consent handling, and data subject requests are configured per state of sale rather than to one national default. Producer licensure and appointment records gate what an agent can quote, which is a compliance control as much as a convenience.
None of this is legal advice, and it does not replace your own agency compliance program. It describes what the platform does so your compliance officer can see where the line sits.
Security contact and responsible disclosure
One address, read by people who can act on what you send.
Report a suspected vulnerability, a data handling concern, or a security question to contact@solvedenroll.com, with "security" in the subject line. Include enough detail to reproduce the issue, the time you observed it, and how you would like to be credited if you want to be. We acknowledge reports, keep you updated while we work the issue, and tell you when it is fixed.
We ask researchers to test only against their own accounts and data, to avoid accessing, modifying, retaining, or exfiltrating anyone else's records, to avoid denial of service and social engineering against our staff or our agencies, and to give us a reasonable window to remediate before publishing. We will not pursue a researcher who follows those terms in good faith. There is no paid bounty program during private beta, and we will say so rather than implying one exists.
For agency-level security review, questionnaires, or a conversation about handling protected health information in your cohort, start at contact and say what you need. For platform availability, the status page is the public record.
FAQs
Security questions
Are you SOC 2 certified or HIPAA certified?
No, and we will not say otherwise. Solved Enroll is in private beta. We operate a documented security and HIPAA program, and formal audit readiness work is underway ahead of general availability. There is no completed SOC 2 report, no third-party attestation, and no certificate to send you today. When that changes we will say so plainly, with the scope and the period covered.
Will you sign a Business Associate Agreement?
We will enter into a Business Associate Agreement where HIPAA requires one, and reviewing it is part of onboarding an agency into a cohort. We are not going to claim an agreement is already in place with any particular party. If your agency needs to see the terms before a cohort conversation, email contact@solvedenroll.com and ask.
Who can see a client health profile?
The agent who owns the case, the people above them in the hierarchy whose role grants case visibility, and the platform staff who need access to support a specific case. Every view is logged with attribution. An agent in another downline cannot open the record at all, and a principal cannot see another agency.
Where is the data stored?
In United States data centers, with encrypted backups. Client records, health profiles, applications, and signed documents do not leave the United States, and the subprocessors that support the platform are reviewed against that requirement before they are used.
What happens to my data if we leave after beta?
You can export it. A complete case file export is available per case, and scheduled or API-driven exports can pull your book out in bulk. Records subject to a carrier or state retention requirement are retained for that period and then aged out, which is a legal obligation rather than a lock-in tactic.
How do I report a vulnerability?
Email contact@solvedenroll.com with enough detail to reproduce it. We acknowledge reports, work the issue, and tell you when it is fixed. Please do not access, modify, or retain another party data while testing, and give us a reasonable window to remediate before publishing.
Do you use client health data to train models?
Client health data is used to produce the recommendation for that client, not to train a general model on your book. The recommender ranks against encoded carrier rules, formulary and plan data, and the profile in front of it, which is also why the same profile returns the same ranking and a past case can be reconstructed.
Something else? Contact us
Need to review this with your compliance officer?
Tell us what your agency has to document and we will walk through the controls, the retention model, and the audit trail with you.