We hold our own data handling to the standard we hold the industry to.

Your documents

When you upload a compensation disclosure:

• It travels over an encrypted connection (TLS) and is encrypted at rest in storage.
• It lands in a private vault scoped to your account — not a public location, and not visible to other users. Only you and the Unbrokered analysts who review it for your account can open it.
• We use it for one purpose: provide your analysis and the account features you request. It does not enter the public Form 5500 peer benchmark. We don't sell it, share it with your broker or PBM, or use it to train a general-purpose model.
• You stay in control. Delete any document from your account at any time. We retain documents only as long as needed for your analysis.

How the analysis works

Your numbers are computed by our engine from public Form 5500 and CMS data — not guessed. Where we use AI, it explains and narrates figures our engine has already calculated; it does not invent prices. We use enterprise AI infrastructure that does not train its models on your data.

Infrastructure and control status

Current subprocessors are Vercel (hosting), Supabase (database and storage), Anthropic (AI features), Stripe (payments), and Resend (transactional email). Each provider maintains its own security and compliance program. Their certifications do not certify Unbrokered.

Unbrokered does not currently claim a completed SOC 2 audit or certification. For a current controls summary, subprocessor questions, or a procurement review, contact security@unbrokered.health.

Control and subprocessor statement last reviewed October 5, 2026.

You're the customer, not the product

On broker-funded platforms, employer research activity can itself become a product — packaged and sold to brokers as sales leads. Unbrokered never sells, shares, or signals your activity to brokers or vendors. Your searches, submissions, and documents exist for one purpose: your own analysis.

What we don't do

• We don't sell your data.
• We don't take referral fees or revenue share from any vendor we might mention as a remedy — so nothing in your analysis is steered by who pays us. (It's the same conflict we exist to expose.)
• We don't share your documents with your broker, your PBM, or anyone else.

A note on confidentiality clauses

A document you share with us may carry its own confidentiality terms. In analyzing it, we act solely as your confidential service provider, on your behalf. If you have questions about your specific agreement, your counsel is the right call.

Questions

Security or data questions: security@unbrokered.health