How your agency's data is protected

This page is maintained by LYNC, LLC to answer the security and privacy questions agencies ask before trusting us with commission data. It describes controls that are in place today. It is not a certification, an audit report, or a substitute for your own due diligence — where you need something in writing for a carrier or compliance review, contact us and we will answer directly.

All traffic between your browser and LyncCIS is encrypted in transit using TLS 1.2 or higher. Data at rest — the database, uploaded carrier statements, generated reports — is encrypted with AES-256 in our managed database and file storage.

Every record is scoped to your agency at the database level. Row-level security policies are enforced on the data layer itself, not just in application code, which means a bug in a screen cannot expose another tenant's rows — the query never returns them in the first place.

Owners, admins, staff and producers each see a different slice of the system. The distinction that matters most in a commission platform is column-level: reporting enforces privacy on individual fields, so an agent cannot see compensation outside their permitted scope even when they build the report themselves.

That filtering follows the data out of the product. A PDF or CSV export is generated through the same role-aware engine as the on-screen report, so exports cannot be used to widen access.

Policy and commission records keep an edit history. Bulk uploads can be undone. Statement imports record who uploaded what and when. Hierarchy changes are attributable to a user and a timestamp, which is what makes a historical distribution defensible months later when an agent asks about it.

New users start with the minimum access their role requires. Greeting sending, statement uploads and hierarchy changes are separately permissioned, so granting someone the ability to import a statement does not also let them restructure your downline or mail four hundred cards.

Your data is retained for a 90-day recovery window after a subscription is cancelled, so an account closed in error can be restored. After that window, agency data is removed. If you need deletion sooner, or need confirmation in writing, contact us and we will handle it directly.

How we handle personal information more broadly is set out in our privacy policy, and the terms governing use of the service are in our terms of service.

Security is split between us and you. We are responsible for the platform: encryption, tenant isolation, access enforcement, audit logging and the infrastructure underneath. You are responsible for what happens inside your tenant — who you invite, what role you give them, removing access when someone leaves, and the compliance obligations that attach to your book of business.

If you believe you have found a security issue, email Support@lyncgreetings.com with the subject "Security", or reach us through the contact page. We will acknowledge and respond promptly. Please do not disclose an issue publicly before we have had a chance to fix it.