Security and data handling
- One brokerage cannot read another’s book
- Tenant isolation is enforced twice: every query is scoped at the application layer, and the database itself applies row level security with FORCE enabled, so the schema owner is subject to the same policies as everyone else. There are tests that assert a cross-tenant read returns nothing rather than trusting that it would.
- Declared medical conditions are encrypted at rest
- A medical application form is medical information about a named person. Rabt encrypts declared conditions at rest, redacts them from application logs, and does not print them on the quote document — the quote states that underwriting applies, not what the member declared.
- Files are served through an authorised route, never a public bucket
- Uploaded documents — licence scans, rate charts, tables of benefits — are reachable only through a route that checks who is asking against what they are asking for. Only PDFs and raster images are served inline; everything else downloads, because rendering an uploaded SVG on this origin would run whatever survived the upload filter.
- Sessions can be ended from the server
- Signing out ends the session in the database, not only in the browser. A user can end every other device from their account page, and an administrator resetting somebody’s password can end their sessions at the same time.
- Passwords are hashed with argon2id, and never stored in readable form
- A temporary password issued with an invitation is shown once and is not retrievable afterwards. Nothing in the audit log records a password, redacted or otherwise.
- Every change is recorded
- Who changed what, when, and what it was before. The audit log is scoped by tenant like everything else, so a brokerage sees its own history and not anyone else’s.
What Rabt does not claim
Rabt does not currently hold ISO 27001, SOC 2 or any other third-party security certification, and this page does not imply otherwise. If a certification matters for your procurement, ask — it is a fair question and it deserves a straight answer rather than a badge.
Security
The questions your compliance officer will ask.
Answered here rather than in a PDF you have to request.
Your book is yours
Every tenant is isolated twice over: once in the queries and again in the database itself, which refuses to return another broker’s rows even if a query asks for them. Tests prove the second one holds when the first is bypassed.
Medical conditions are encrypted
Declared conditions are encrypted at rest with a key the application holds, and redacted out of every log line. They are the most sensitive thing on the platform and they are treated that way.
Everything that changes is recorded
An append-only audit trail covers every mutating action — who, what, when, and the before and after. Sensitive values are redacted as they are written, not filtered later.
Quotes stay reproducible
A generated quote freezes the benefit and rate versions it used. Re-rendering months later reads the frozen versions, so the document a client received can always be produced again.
Files are not public URLs
Documents are served through short-lived signed links tied to your session, not guessable paths. A shared quote link expires on a date you set.
Hosted in the UAE
The application and its database run on infrastructure in the region, under rabt.ae over TLS.
Related
See it on your own rate charts
Rabt is not a demo account with somebody else’s plans in it. Load one insurer’s rate chart and table of benefits, and quote from them the same day.