IT, security and AI governance for independent agencies. The FTC Safeguards Rule applies to you as a financial institution, your carriers are asking harder questions every renewal, and your own E&O carrier is one of the people watching. We make the answers real.
You spend your days explaining risk to clients. These are the ones that sit on your side of the desk.
Someone drafting a proposal faster with real policyholder information in it. Under GLBA and the Safeguards Rule, non-public personal information is exactly what you are required to protect.
An email that looked right, new account details, a client who thought they’d paid. The money is gone and the conversation that follows is about your controls.
The FTC Safeguards Rule expects one, with a named person responsible. Many agencies discover this during a carrier review rather than before it.
A breach of client data is not only an operational problem. It is a professional liability question, and your carrier will ask what you had in place.
The specific controls the Safeguards Rule expects, documented rather than described.
The document the Safeguards Rule expects, with a named owner, kept current instead of written once.
What may go into which tools, what never may, and who approves a new one before the team starts using it.
A second check before anyone reaches client data or the agency management system.
A verification step before any account detail changes, documented, so urgency never replaces the process.
Policy files, correspondence and the management system — proven recoverable on a schedule.
Your answers written down and current, so renewal season is paperwork rather than panic.
Independent agencies are generally treated as financial institutions for this purpose, so yes — the common surprise is the written program and the named responsible person, not the technical controls. We’ll walk through what applies to your agency specifically rather than hand you a generic checklist.
We build and document the controls your obligations require and prepare the evidence a carrier or regulator asks for. We don’t issue certifications and we’re not your attorney. What changes is that the answer exists in writing before somebody asks for it.
We don’t control underwriting and anyone promising you a discount is guessing. What we can do is let you answer the questionnaire confidently and document the answers — which is the part that is actually within your control.
Their infrastructure is. Your obligations cover how your people sign in, what’s on their machines, who still has access after leaving, and every other vendor touching client data.
A predictable monthly agreement based on headcount and what shape things are in. You see the figure before you commit.
Tell us what’s going on and an advisor calls you back within one business day. We ask about your business before we say anything about ours. No pitch deck, no pressure.
Regulatory guidance on this page last reviewed October 2026.