How the Insurance Data Trust works: consent receipts, a visible access log and an anonymous pool

Most people in insurance have signed a data-sharing agreement and then lost sight of what happened next. Where did the records go? Who opened them? Were they passed on? For years the honest answer has often been "we don't know." That gap is what makes opaque data resale possible, and it is why a pledge to treat data responsibly needs working parts behind it.

The Insurance Data Trust is InsurEco's answer to that gap. This post walks through how it works in plain terms, so an agency owner, an MGA, a carrier operations lead or a regulator can picture using it. The full reference is on the Insurance Data Trust — How it works page.

The starting point: every record has an owner

Everything in the Trust starts from one rule: every record has an owner. A record is not a loose file that drifts from system to system. It belongs to someone, and that owner decides whether it is shared.

That sounds simple, but it changes the default. In opaque data resale, the default is that data moves unless someone stops it. In the Trust, data stays put unless its owner agrees to share it.

When an owner agrees to share data, the Trust issues a consent receipt. Think of it the way you think of a receipt at a counter: a record that a specific transaction happened.

The point of a receipt is that you keep it. You do not have to rely on a counterparty's memory or on a clause buried in a contract. You can go back and check what you agreed to.

For an agency, that means a clear answer when a client asks, "Did you share my information, and with whom?" For a carrier, it means being able to show that the data it is working with came in with consent attached.

The rule underneath is short: data is shared only with consent. The consent receipt is how that rule becomes something you can hold on to.

The visible access log: every access, recorded

Consent covers the decision to share. The access log covers what happens afterwards.

In the Trust, every access is visible and logged. When a record is opened, that access is written to a log the record's owner can see. Nothing is reached quietly in the background.

This is the part that most directly replaces "we don't know." Instead of trusting that a counterparty is using data the way they said they would, an owner can look at the log and see.

For regulators, a visible log changes the shape of an inquiry. The question moves from "tell us what you did" to "show us the record." For operations teams on the carrier and reinsurance side, it gives a single place to check how data has moved, rather than reconstructing it from emails and spreadsheets.

The Trust is secured on InsureBio, the insurance data chain, which is the record-keeping layer underneath consent receipts and the access log.

The anonymous pool and the protections around it

The third part is the anonymous data pool. Not every useful question needs to know who a policyholder is. Many of the questions the industry asks are about patterns across many records rather than any one person.

The anonymous pool exists for that kind of use. Contributed data enters the pool without the details that identify individuals, and the Trust puts privacy protections around the pool so that it stays anonymous. The specific protections are set out on the How it works page, and we would rather you read them there in full than take a summary on faith.

The same principles still apply in the pool. Contributing to it is a consent decision made by the record's owner. It does not happen by default.

What this looks like for an agency

Picture an agency deciding whether to share records. In the Trust, the sequence is:

The agency owns its records.
It decides whether to share, and with whom.
If it agrees, it gets a consent receipt.
From then on, it can see every access to those records in the log.
Separately, it can choose whether to contribute to the anonymous pool.

At no point does the agency have to guess where its data has gone.

What this looks like for a carrier or MGA

For a carrier or MGA receiving data, the Trust offers the other side of the same picture. Data arrives with a consent receipt behind it, so there is a clear basis for using it. Access is logged, so there is a record to point to if a question is raised later. And where the question is about patterns rather than individuals, the anonymous pool offers a route that does not involve identifying anyone.

That is a different footing from buying data whose origin is unclear.

Why the mechanics matter more than the pledge

It is easy to promise transparency. It is harder to build a system where transparency is the default and anyone involved can check it. The Insurance Data Trust is built around three things you can point to: a consent receipt for every share, a log entry for every access, and an anonymous pool with protections around it.

If you want the detail behind each of these, start with the Insurance Data Trust — How it works page.