PolicyChecked

Overview

A secure document-intake and renewal-preparation platform for South Dakota families, contractors, and small businesses. People store their policies, get an AI analysis in plain English, and request a review from a licensed producer.

The problem

Small businesses and families keep insurance in drawers and inboxes, then face renewals with no idea what they have or what's missing. The product had to help without becoming something it legally can't be: not a quote engine, not a comparison tool, not an underwriter.

What I built

• Customer app: policy and document intake with automated document summaries, a readiness score, coverage-gap reviews, and renewal reminders.
• Staff, producer, and admin app with review requests, information requests, notes, and role-based access.
• AI document analysis that explains coverage in plain English, with written compliance boundaries enforced in the product and in its copy.
• Security hardening: row-level security on every table, MFA, PII-redacted structured logging, rate limiting, and an incident-response runbook.

Architecture

• Next.js 16 (React Server Components, Server Actions) on a single Graviton (ARM) EC2 instance behind CloudFront, with S3 for static assets.
• The origin only accepts CloudFront's managed prefix list plus a secret header; deploys run through SSM Run Command, with no SSH and no open admin ports.
• Everything is defined in one CloudFormation stack and built in CodeBuild. Releases are content-addressed and cached by architecture, with automatic rollback if a release doesn't answer its health check.
• Supabase Postgres with RLS and private storage, nightly database backups to S3, scheduled jobs, SES email with inbound forwarding, and CloudWatch auto-recovery alarms.
• Runs for about $15 a month after a FinOps pass that moved it from x86 to Graviton.

What I learned

• Write the compliance boundary down first. It decided the features, the copy, and the data model.
• Changing CPU architecture is never just an instance-type change: the native binaries, build images, and cached releases all have to follow.