Insurance agencies: applications, IDs and the desktop problem

Ask an agent where a client's application lives and the answer is usually "in the agency management system." Ask where the PDF the carrier portal produced lives, and you may get a longer pause. Insurance work generates a steady stream of documents that need to move between a client, an agent and a carrier, and the easiest place to drop them is the desktop.

This guide covers how personal data piles up in insurance offices, where to look, and a repeatable cleanup. It is general education, not legal advice; confirm your state's requirements with an attorney or your compliance contact. Your agency page is at /for/agencies-and-firms/.

How the desktop problem forms

Picture a small agency with five people. A client sends a photo of a driver's license by email for a quote. The agent saves it to the desktop, uploads it to the carrier portal, and moves on. The portal sends back a completed application PDF, saved to Downloads. A week later the policy binds and the file is long forgotten. Multiply by every client, every renewal, and every agent's preferred habit, and you have hundreds of documents with personal details sitting outside any system anyone manages.

Nothing here is careless in the moment. Each step is a reasonable shortcut. The problem is only that nobody circles back.

What tends to be in those files

• Applications. Names, dates of birth, Social Security numbers on some lines of business, driver's license numbers, and sometimes bank account details for premium payments.
• ID copies. Scans or photos of licenses and passports saved for identity checks.
• Quote worksheets. Spreadsheets used to compare options, often with the same personal details in a row per client.
• Health information. For health and life lines, forms and notes that read like health records.
• Payment details. Card numbers typed into notes or pasted into a document for a payment taken by phone.
• Email exports. Messages saved as .eml or .msg files with attachments intact.

What a scan finds and what it does not

MyVaultMate looks for Social Security numbers and ITINs by pattern, payment card numbers by pattern plus a Luhn check, and driver's license, passport and date-of-birth values only when they sit beside a label such as "DL no.", "passport" or "DOB." A bare number with no label will not be flagged as a license. Health information is a keyword signal that a file reads like a medical record, not a way of identifying individual records. Files read include Word and Excel (new and old formats), PDF, text, CSV, JSON, XML, HTML, .eml and Outlook .msg messages. Pictures, videos, recordings and scanned PDFs are not read; they are listed as “Not scanned” with a risk score of 70. RTF and PowerPoint files, Outlook .pst data files, and zip archives are not scanned yet, so give those a manual look.

The tool ranks findings by severity and by computer. It moves or deletes nothing on its own. Those decisions belong to you or your IT provider.

Two regulatory notes, kept short

Every US state has a breach-notification law, and the triggers and deadlines vary, so check the current law for the states where your clients live. In Nevada, NRS Chapter 603A requires businesses that hold Nevada residents' personal information to maintain reasonable security measures. Personal information there generally means a name plus items like an SSN, driver's license, or account or card number with an access code. Your state or carrier agreements may add their own requirements. And if you take card payments, the PCI standard at https://www.pcisecuritystandards.org applies; the simplest path for a small office is to avoid storing card numbers at all and use a tokenizing processor.

A practical cleanup checklist

1. Decide the rule: carrier documents live in the agency management system or the carrier portal, not on desktops.
2. Run a scan on every computer and any shared external disks.
3. Sort by severity. Start with spreadsheets containing many people, then single ID copies (pictures are not read, so those are on the Not scanned list at a risk score of 70).
4. For each hit, ask whether it already exists in the management system. If yes, remove the stray copy. If no, file it properly first.
5. Pull card numbers out of notes and documents; correct the habit that put them there.
6. Check your retention obligations with your attorney or compliance contact before removing older client files in bulk.
7. Show each agent where their Downloads and Desktop stand on the dashboard, so the habit change is concrete.
8. Keep scans running on their schedule (hourly by default), so new strays surface within hours, not years.

Making it stick

A one-time cleanup decays. Give each person a short rule they can remember, such as "nothing stays in Downloads past Friday," and use the weekly scan as the friendly check. New organizations default to hourly incremental scans, which re-read only changed files, and you can change that to daily or weekly. Scans back off while someone is using the computer.

You can see what a report looks like at /sample, or start a 14-day trial at /trial/ (a card is required and never charged automatically: the 14 days start at your first computer, and you choose a plan when they end).