Trust Center
How MySSAgent protects the information you and your clients share with us, and what an independent auditor has examined.
Last reviewed
How we protect your data
What we do, what we never collect, and who has examined it.
No Social Security numbers
Social Security numbers are never transmitted to or stored on our servers. The product has no field for one. Your SSA statement is read in your browser, and we never read a Social Security number from it. From the statement we keep your earnings history, date of birth and SSA's benefit estimates. In the Advisor Portal, the client's name is also read from it to fill in the form.
SOC 2 Type I report issued
KEN & Co., an independent CPA firm, issued our SOC 2 Type I report on September 14, 2026. It examines the design of our controls as of July 31, 2026, across Security, Availability, Confidentiality and Privacy. The report covers the MySSAgent software application, which we deliver to advisors and to individuals. Other services we provide are outside its scope. A Type II examination is under way, with an observation period of August 1 to October 31, 2026.
Encryption in transit and at rest
Traffic between your browser and MySSAgent is encrypted with TLS, and the site is served only over HTTPS. Stored data is encrypted at rest with AES-256 by our hosting platforms.
AI with clear limits
Benefit calculations run on a deterministic, rules-based engine. No AI model computes a benefit figure. Anthropic's Claude writes the plain-language explanation in a report and answers chat questions, and it is called from our servers. If the AI provider is unavailable, the report still renders with a standard explanation.
Access control
Row-level security, set to deny by default, keeps each advisor's clients separate from every other account. Multi-factor authentication protects the critical systems we use to run the platform, and access follows least privilege. Signed-in sessions end automatically after 8 hours of inactivity.
Monitoring and alerts
Automated health checks sample the production database every 15 minutes and alert us when a threshold is crossed. An external uptime monitor checks the site and alerts us if it becomes unreachable. Dependency scanning runs continuously, and a compliance platform monitors our security controls.
How we handle your data
What we collect, how long we keep it, and who else sees it.
What we collect
We collect what the analysis needs: your name and contact details, date of birth, marital status, earnings history and benefit estimates. An advisor may add optional intake answers for a client. We never collect a Social Security number.
Retention and deletion
Analysis inputs are kept for seven years after the relationship ends, which covers an advisor's own recordkeeping period. Forms that were started and never submitted are deleted after 90 days. You can ask us to delete your information at any time, and we honor the request unless the law requires us to keep specific records.
No sale of personal information
We do not sell, rent or trade personal information. We share it only with the service providers that run the platform, and each one is named in our Privacy Policy.
See the list in our Privacy PolicyPayments
Card payments are processed by Stripe on Stripe's own checkout pages. Card numbers never reach our servers.
Where your data lives
Managed cloud platforms
The application runs on Vercel. The database, sign-in and analysis servers run on Supabase. Both providers maintain their own SOC 2 Type II reports.
United States data hosting
The production database is hosted in the United States, in the US East (Ohio) region.
Network protection
DDoS mitigation is provided by our hosting platforms. The application and the database web APIs accept only encrypted HTTPS connections.
Backups and recovery
The production database is backed up every day, and backups are kept for seven days. We test restoring from backup and maintain a documented disaster recovery plan.
Testing and vulnerability management
We scan dependencies continuously, review platform security advisories, and commission penetration testing from an independent third party.
An independent security firm, Astra Security, completed a manual penetration test of the application in September 2026. Findings are ranked by severity and tracked through remediation and re-test.
After the re-test, Astra graded the site A+ and issued a security audit certificate on October 2, 2026, valid until October 2, 2027. Verify the certificate on Astra's site
Report a Vulnerability
We value the security community's help in keeping our users safe. If you discover a security vulnerability, please report it responsibly.
Security Contact:
patrice@myssagent.comPlease include a detailed description of the vulnerability and steps to reproduce. We respond within 48 hours.
Responsible Disclosure Policy
- We will acknowledge receipt within 48 hours
- We will provide a timeline for remediation
- We will notify you when the issue is resolved
- We will not pursue legal action for good-faith reports
Questions about our security practices?
We are glad to walk you or your compliance team through any of this.