Last updated: November 3, 2026
Protecting your information is one of our highest priorities. My Benni AI, operated by Benni Inc. (“Benni,” “we,” “us”), is designed to help people manage sensitive benefits, insurance and healthcare information. We understand that this information deserves strong protection.
Our security program focuses on protecting the confidentiality, integrity, and availability of your information. Some of the ways we help protect your information include:
- Encryption during transmission and while stored
- Secure cloud infrastructure
- Strong authentication
- Role-based access controls
- Continuous monitoring
- Audit logging
- Disaster recovery planning
- Vendor security reviews
- Responsible use of artificial intelligence
No security system is perfect, but we continually review and improve our security practices.
Our Security Approach
Security is built into every stage of our platform. We follow industry best practices to reduce risk and protect user information. Our security program includes:
- Administrative safeguards
- Technical safeguards
- Physical safeguards
- Secure software development practices
- Ongoing monitoring
- Regular security improvements
We regularly review our policies and procedures as our platform grows.
Cloud Infrastructure
My Benni AI is hosted on Amazon Web Services (AWS). AWS provides secure cloud infrastructure that helps us deliver reliable and scalable services. Our cloud environment is designed to support:
- High availability
- Secure storage
- Network security
- Disaster recovery
- Backup and recovery
- Monitoring and logging
We regularly review our cloud environment to improve security and reliability.
Encryption
We use encryption to help protect information both while it is being transmitted and while it is stored.
Data in Transit
Information exchanged between your browser, the mobile application, our servers, and supported third-party services is transmitted using Transport Layer Security (TLS) version 1.2 or higher. This helps protect information from unauthorized access while it is being transmitted over the Internet.
Data at Rest
Sensitive information stored within production systems is protected using encryption at rest. This includes production databases, file storage (such as uploaded receipts, bills and insurance cards), and backups where applicable. Encryption keys are managed using secure cloud services with access limited to authorized personnel.
Authentication
Protecting user accounts is an important part of our security program. My Benni AI uses secure authentication technologies to help protect user accounts. Members authenticate using secure account credentials.
Authorization
Users control who can access their information. Our systems are designed to enforce these permissions throughout the platform. Members decide:
- Whether to connect benefits, insurance or healthcare accounts
- Whether to add family members
- Whether to share information with an employer, benefit provider or insurance company
- When to remove access
Access Controls
Access to information is limited based on business need. Examples include:
- Role-based permissions
- Least-privilege access
- Authenticated sessions
- Controlled administrative access
Only authorized personnel may access production systems when required to perform their job responsibilities. Access is reviewed and updated as needed.
Mobile Security
My Benni AI is available through both web and mobile applications. Users are encouraged to protect their devices with strong passwords or biometric authentication. The mobile application is designed to help protect user information by:
- Using encrypted communications
- Requiring authenticated access
- Limiting locally stored sensitive information
- Using platform security capabilities provided by iOS and Android
Account Security
Users can help protect their information by:
- Choosing a strong password
- Keeping devices updated
- Protecting mobile devices
- Signing out when using shared devices
- Reporting suspected unauthorized access
If you believe your account has been compromised, please contact us as soon as possible.
Security Monitoring
We monitor our systems to help identify unusual activity and security events. Monitoring may include:
- Application monitoring
- Infrastructure monitoring
- Audit logging
- Error reporting
- System alerts
When appropriate, we investigate suspicious activity and take steps to protect our users and our platform.
Backup and Disaster Recovery
Protecting your information means planning for unexpected events. We maintain backup and recovery processes designed to help restore our systems if there is a hardware failure, service interruption, natural disaster, or other unexpected event. Backups are encrypted and stored securely. Backup information is used only for disaster recovery and business continuity purposes.
If you request deletion of your information, we will remove it from our active production systems as described in our Privacy Policy. Encrypted backup copies may temporarily retain deleted information until backup retention periods expire or backup media is securely overwritten.
Vendor Security
We work with trusted companies that help us operate My Benni AI. Before selecting vendors, we consider factors such as:
- Security practices
- Reliability
- Privacy protections
- Compliance obligations
- Ability to protect sensitive information
When vendors create, receive, maintain, or transmit Protected Health Information (PHI) on our behalf, we require them, where applicable, to sign Business Associate Agreements (BAAs) and maintain safeguards consistent with HIPAA and other applicable laws. We review our vendors periodically and may update this list as our platform evolves. Examples of our service providers include:
| Provider | Purpose |
|---|---|
| Amazon Web Services (AWS) | Cloud hosting, databases, storage, backups |
| Auth0 | Authentication and identity management |
| Firebase | Mobile application services |
| Supabase | Backend services |
| Twilio | SMS notifications |
| SendGrid | Transactional email delivery |
| Stripe | Payment processing |
| Mixpanel | Product analytics |
| Google Analytics | Website analytics |
HIPAA Safeguards
My Benni AI is designed to support the secure handling of Protected Health Information. Our privacy and security program includes safeguards intended to support compliance with applicable healthcare privacy and security requirements. These safeguards include:
- Access controls
- Encryption
- Audit logging
- User authentication
- Vendor oversight
- Workforce training
- Security policies and procedures
Where required, we enter into Business Associate Agreements with vendors that handle Protected Health Information on our behalf.
Artificial Intelligence Security
Artificial intelligence is used to help users organize their benefits, read uploaded documents and review information more efficiently. We design AI features with privacy and security in mind. Our goal is to minimize the information shared with AI services whenever possible and to use appropriate safeguards to protect sensitive information.
AI is intended to assist users. AI does not replace healthcare professionals, benefits administrators, insurance professionals, or professional judgment. Users should always review important information before making healthcare, benefits, insurance, or financial decisions.
Security Testing and Improvement
Security is an ongoing process. As our platform grows, we continue to evaluate additional security controls and industry best practices. We regularly review and improve our platform by:
- Updating software and infrastructure
- Monitoring for security issues
- Reviewing access controls
- Improving internal processes
- Responding to newly identified risks
Security Incident Response
If we discover a security incident, we follow established response procedures. Our response may include:
- Investigating the issue
- Containing the incident
- Restoring affected systems
- Working with appropriate experts when needed
- Improving security controls to reduce future risk
When required by law, we will notify affected users in accordance with applicable federal and state laws. Additional information about breach notifications is available in our Privacy Policy.
Responsible Disclosure
We appreciate responsible reporting of potential security issues. If you believe you have identified a security vulnerability involving My Benni AI, please contact us. Please include enough information for us to investigate the issue. We ask that you:
- Avoid accessing information that does not belong to you.
- Do not disrupt our Services.
- Give us a reasonable opportunity to investigate before publicly disclosing the issue.
We review all reports and appreciate the efforts of security researchers who help improve the safety of our platform.
Continuous Improvement
Technology, privacy laws, and cybersecurity threats continue to evolve. We regularly review our security program and make improvements to strengthen the protection of our users and their information. Our goal is to continuously improve, not simply meet minimum requirements.
If you have questions about security or would like to report a potential security issue, please contact us at info@mybenni.ai.