Skip to content

Software companies

Agency management system vendors: agency-owned data and what you can license

By SourceX Editorial · Reviewed by Noah Loul ·

Short answer

In an agency management system, the agency usually owns its client and policy data, including expirations, unless a contract says otherwise; the AMS vendor holds that data only to provide the service. What stays the vendor's is its own work: source code, support cases, conversion runbooks, carrier integration engineering and product history. License that layer, never the agency's book.

Key takeaways

  • Client records, policy details and expirations belong to the agency, not to the AMS vendor that hosts them.
  • Most AMS contracts limit vendor use of agency data to providing, supporting and improving the service.
  • Vendor-owned records include code, support cases, data conversion runbooks and carrier download mappings.
  • Agency support tickets carry client and policy details that must come out before any licensing.
  • Adding a right to train on agency data by updating terms needs clear notice and the agency's agreement.

Who owns the data in an agency management system?#

The agency owns the data in an agency management system: client records, policies, coverages, claims notes, activities, attachments and the expirations that make up its book of business. Independent agency agreements with carriers commonly treat expirations as agency property, and AMS contracts generally follow the same logic by treating everything an agency enters or downloads as the agency's data.

The AMS vendor's role is to host, process and support that data. Mainstream SaaS terms state the allocation plainly; Zendesk's AI services addendum, for instance, says that as between the parties the customer is the sole owner of all service data, including AI input and output. Agencies expect at least that from their AMS, so check whether your own contract says it explicitly or leaves it implied.

What the AMS vendor owns#

The AMS vendor owns the records it created while building, implementing and supporting the system. Each of those records is vendor work product, yet most contain agency material, and owning the record does not clear the confidential content written inside it.

What the AMS vendor owns
Vendor recordWhere it livesWhat to remove
Source code and release historyGitHub, GitLab or Azure DevOpsAgency-specific customizations, credentials, third-party code
Defect and feature issuesJira or another trackerPasted client records, policy numbers, screenshots
Support casesZendesk, Salesforce or FreshdeskAgency names, client names, policy and claim details
Data conversion runbooksConfluence, SharePoint, project foldersSample records from the agency's prior system
Carrier download and integration mappingsIntegration code and specificationsCarrier confidential specs, test files with real policies
Implementation and training recordsProject tools, training recordingsAgency staff names and client examples
Product decisions and roadmapNotion, Confluence, SlackNamed agency feedback and commercial terms

Which AMS vendor records are worth licensing#

The AMS vendor records worth licensing are the ones that capture insurance operations expertise with an outcome attached. A support case that walks from a failed carrier download to the mapping fix, or a conversion runbook explaining how a prior system's policy and activity records were reconciled, teaches more than a generic product manual.

Those records suit teams building AI agents for agency workflows, document understanding models for insurance forms, and coding agents that work in regulated software. Records without outcomes, such as raw call queues or unlinked tickets, rank lower, and records dominated by client details rank lowest because preparation would strip most of their content.

Why AMS support tickets need the most care#

AMS support tickets need the most care because agency staff paste real data into them. A customer service rep asking why an endorsement did not download will include the policy number, the named insured and sometimes a screenshot of the client's coverage page.

Those tickets are valuable for the same reason they are risky: they show expert diagnosis of insurance workflows, from download errors to commission reconciliation and renewal processing. Preparing them means removing client and agency identifiers, dropping attachments unless each one is reviewed, and keeping the problem, the diagnosis and the fix.

  • Replace named insureds, agency names and staff names with consistent placeholders.
  • Remove policy, claim, account and producer codes.
  • Exclude screenshots, attachments and exported reports by default.
  • Remove carrier names where agreements treat carrier relationships as confidential.
  • Keep ticket category, product module, resolution steps and linked engineering issues.

Contract clauses to check in AMS agreements#

Clauses in AMS agreements decide what the vendor may do beyond running the system. Read the agreement, the order form and any data security exhibit together, since larger agencies and agency networks often negotiate their own terms.

Contract clauses to check in AMS agreements
ClauseTypical AMS wordingWhat it allows the vendor
Definition of agency dataEverything the agency enters, imports or downloadsNothing beyond hosting and support
Permitted useTo provide, support and improve the servicesInternal product work; no outside licensing
Aggregated dataDe-identified statistics across agenciesBenchmarks inside the product, rarely more
ConfidentialityAgency business information and carrier relationshipsRequires removal from vendor records
Data return on terminationExport of the agency's data, then deletionNo retained copies for other uses
Changes to termsNotice before changes take effectNo silent expansion of data use

Why updating terms to allow training is risky#

Updating AMS terms to allow training on agency data is risky because agencies will read it as a change to who controls their book. An aggregated data right usually supports benchmarks inside the product, not licensing agency data to outside developers, and stretching it invites disputes.

The people in the records add a second layer. Policyholders are consumers, so federal financial privacy rules under the Gramm-Leach-Bliley Act, along with state insurance privacy laws, may govern how their details are used regardless of what the AMS contract says. This is general information; contract terms and privacy duties are reviewed deal by deal with counsel.

Illustrative: an AMS vendor scopes a licensing review#

Illustrative: a fictional AMS vendor serving independent property and casualty agencies keeps its engineering and support history in Jira, Bitbucket, Salesforce Service Cloud and Confluence, going back many years. The CEO asks a narrow question: which of the company's own records could go into a license while every agency's book stays untouched?

The review excludes every agency database and any aggregated agency data. It keeps engineering issues linked to commits, support cases about download, accounting and renewal workflows, and data conversion runbooks. Support cases go through placeholder replacement, and attachments are excluded.

The CEO also prepares a short statement for agencies: agency data stays the agency's, is used only to run the AMS and is never licensed, while vendor records with agency details removed may be. The same words go into the trust page, questionnaire answers and the contract template, because inconsistent statements cause more concern than the licensing itself.

How SourceX approaches AMS vendor records#

SourceX reviews AMS vendor archives with the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. During Rights, agency data is set aside first and each remaining vendor record is checked for clear title, and the vendor approves every step.

Value is weighed with the SourceX Enterprise Data Value Framework, where domain expertise and human-generated signal count in favor of insurance support histories and privacy burden reduces net value. Each package the vendor approves ships with a SourceX Evidence Packet covering its provenance, the licensing rights behind it, the permitted use, a privacy record of what was removed, and the release authorization.

Frequently asked questions

Does an agency own data downloaded from carriers into the AMS?

The AMS contract usually treats downloaded policy data as agency data, though the carrier may also have rights and confidentiality terms in its agency agreement. Either way it is not the vendor's to license. The vendor's integration code and mappings, without real policy data, remain vendor records.

Can we use agency data to build AI features inside our AMS?

Only as the contract permits, which is often limited to providing and improving the service for that agency. Training shared models across agencies is a different use. Get clear contract language and give agencies notice and a choice before relying on it.

What happens to agency data when an agency switches systems?

Most AMS contracts require an export and then deletion after a defined period. Agencies care because their book moves with them. Follow the contract, and confirm deletion in writing, including copies held in analytics or AI pipelines.

Is support ticket metadata safe to license?

Metadata such as module, category and resolution time carries less risk than ticket text, but it can still identify an agency when counts are small or fields include names. Review it with the same placeholder rules before it goes into any package.

Do agency network or cluster agreements change the picture?

They can. An agency network may negotiate master terms for its members, including stricter data use and confidentiality clauses, and may expect notice of anything that touches member data. Check network agreements alongside individual agency contracts before deciding which vendor records are clear.

Should we ask agencies for permission anyway?

When a package holds nothing from agency databases and nothing confidential, the contract may be silent on permission. Some vendors still inform agencies or offer an opt-out from having their tickets included, which costs little and builds trust with a customer base that talks to each other.

Sources

  • Zendesk's AI Services Addendum states that, as between the parties, the customer is the sole owner of all Service Data, including Customer AI Input and AI Output. Source

Related resources

See if your company qualifies

A short company assessment. No data uploads are needed.

See if you qualify