AvowSecurity
Client data is stored in the UK, and stays with the right people.
A broker's clients trust it with the details of their business. This is how Avow looks after them, in plain words.
Stored in the UK
Client and broker data is stored in the UK, in a database in London.
The database enforces access
The rules are in the database, not just on the page. A firm's data is visible only to that firm's members, and the rules are tested before they are applied.
Only what's needed
We collect only what a broker needs to place the insurance, and keep it only as long as the firm's own retention rules require.
What "stored in the UK" covers
The database that holds enquiries, client areas and accounts runs in London. The app and this website are delivered over Cloudflare's worldwide network, which carries their files but not clients' enquiries: those go from the client's browser to the database in London.
A few things happen outside the UK. If a client chooses to speak their answers, their browser sends the sound to its maker's speech service (see below). And staff at our service providers, which are US-owned companies, may reach information from outside the UK to support the service.
Who can see what
- Signed-out visitors can read nothing, apart from a firm's public brand: its name, colours and logo.
- Clients see only their own enquiries and client area.
- Account executives see only the enquiries assigned to them.
- Managers see every enquiry in their own firm, and nobody else's.
- Changes are recorded. Status, owner and client-area changes, and each client's consent, are written to a log that can only be added to.
Signing in
- Every account has a password. A new account also confirms its email with a six-digit code.
- An invitation link isn't treated as proof of identity: it can be forwarded, so the person it reaches still confirms their email.
- Invitations expire, and work only for the person invited.
- A live enquiry is kept in the database, not on the device. Only the sign-in session stays behind.
Voice, in the open
When a client speaks, Avow keeps the words, never the audio. The speech is turned into text by the browser's own speech service, which is Google's in Chrome, Microsoft's in Edge and Apple's in Safari. Clients who would rather not use it can type.
The demo
The demo uses made-up data and never real client data. We ask for a work email and a job title before it starts, and keep them so that we can follow up about Avow.
Found a problem?
Tell us privately at avow@avowventures.co.uk and put "Security" in the subject. We confirm your report within three working days, and we won't take action against good-faith research. Please test only against your own data or the demo.
Doing a security review of Avow for your firm? We'll answer your questions.
Questions for your security review?
Book a call and we'll go through how Avow handles your clients' data.