How Claimiflo Protects Your Data

We handle sensitive unclaimed property records for businesses across the United States. Security is foundational to our platform, not an afterthought.

Data Protection

  • Encryption at rest — PII fields (EIN, tax identifiers, phone numbers, email addresses) encrypted using AES-256 in the database
  • Encryption in transit — All data transmitted over TLS 1.2+
  • HSTS enforced — Strict Transport Security on all domains prevents protocol downgrade attacks
  • Tenant isolation — Each company's data is isolated at the database level with enforced query scoping
  • Encrypted sessions — Session data encrypted at rest with secure, HTTP-only cookies

AES-256 Encryption

The same standard used by banks and government agencies

Role-Based Access

Granular permissions ensure users only see what they need

Authentication & Access Control

  • Two-factor authentication — Multi-factor authentication enforced for all administrative accounts
  • Role-based access control — Admin, Client Admin, and Client Member roles with distinct permissions
  • Strong password policy — Minimum 12 characters with complexity requirements
  • Brute force protection — Automatic account lockout after repeated failed login attempts
  • API rate limiting — Throttled endpoints prevent abuse and credential stuffing
  • Session timeout — Automatic session expiration after idle period

Monitoring & Audit Logging

  • Authentication logging — All login, logout, failed attempts, and authorization failures logged with IP address and timestamp
  • Data change tracking — Full audit trail for all status changes and data modifications
  • Daily log rotation — Automated daily rotation with 90-day retention for incident investigation and compliance
  • Quarterly access reviews — Periodic review of user access, MFA enrollment, and inactive accounts

Comprehensive Audit Trail

Authentication and status changes are logged for accountability and compliance

Isolated Infrastructure

Dedicated servers with resource isolation for maximum security

Infrastructure

  • Dedicated cloud hosting — Hosted on Hetzner Cloud with EU-grade data center standards
  • Resource isolation — Separate application and processing servers
  • Security headers — CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and HSTS
  • CSRF protection — Cross-site request forgery prevention on all forms
  • Continuous dependency auditing — Automated CVE scanning across PHP and Composer packages, with prompt patching of identified issues

Backup & Disaster Recovery

  • Daily database backups — Automated full backups of the production database
  • Off-site retention — Backup copies retained off-site under restricted access
  • Restore verification — Backup integrity and restore procedures tested on a recurring basis
  • Documented recovery plan — Defined procedures for service restoration in the event of an outage or data loss

Tested Recovery

Backups verified on a recurring basis, not just configured and forgotten

Code-Level Security Audit

Our codebase undergoes regular 30-point vulnerability assessments covering the OWASP Top 10 and Laravel-specific attack vectors.

  • SQL injection prevention — Database access uses parameterized queries and ORM bindings
  • Command injection prevention — Shell execution is avoided and user input is never passed to system calls unsanitized
  • XSS prevention — Dynamic output is escaped by the templating framework and reviewed against cross-site scripting
  • Mass assignment protection — Explicit field whitelisting on all models

30-Point Assessment

Regular vulnerability audits across all attack vectors

Formal Security Policies

Documented controls aligned to SOC 2 Trust Services Criteria

Compliance

Claimiflo follows SOC 2 Trust Services Criteria for security, availability, and confidentiality. We are actively building toward formal SOC 2 Type I certification. All security policies are reviewed annually and after any material change.

  • Information Security Policy — Umbrella policy covering data classification, acceptable use, and sub-policy index
  • Access Control Policy — Documented controls for tenant isolation, role enforcement, and MFA requirements
  • Incident Response Plan — Severity classification, response procedures, communication plan, and post-incident review
  • Data Retention & Disposal Policy — Defined retention schedules, secure disposal methods, and customer deletion requests
  • Security Awareness Training — Annual training requirements and role-specific security education

For security inquiries or to request our security documentation, contact us at support@claimiflo.com.

Responsible Disclosure & Transparency

We welcome reports from security researchers and act on them quickly. If you believe you have found a vulnerability in our platform, please contact us at support@claimiflo.com with details. We commit to acknowledging valid reports promptly and keeping you informed as we investigate.

Live operational status and historical uptime are published at status.claimiflo.com.

Open Door for Researchers

Security findings reported in good faith are always welcome

Ready to Get Started?

Join businesses that trust Claimiflo to manage their unclaimed property securely.

Start Your Free Trial

This page is maintained as part of our security disclosure program. Last updated: June 23, 2026.