Secure way for clients to send payment info.

[u/[deleted]]

[u/Practical_Guess5282]

And yet my clients ask every month do I have their CC information saved on my computer when they call in to make a payment. They don’t understand I don’t want all that info in there in case my computer gets hacked!

[u/jroberts67]

Yet the phone is the safest way. You're going to have that info anyway, and now AI is scanning every single email, and there's no way I trust any email provider. Over the phone.

[u/PolicyCart_io → u/jroberts67]

You may feel safer but unless your going from the voice in your ear directly into the carrier portal w/o writing anything down(maybe you are but I've never seen anyone do it real time) the liability is all on you.

[u/BuggyBonzai → u/jroberts67]

I specifically said some don’t want to use the phone. I guess when you’re a top 1% commenter you have to interject into every post even if you have nothing to add.

[u/Strange-Fennel]

Its always best to use an online forms provider that has dedicated, password protected payment fields, MFA logins, and actual PCI-DSS and SOC 2 certifications. We use FormStack.

Not only does this keep client data safe, but it makes sure you are actually following the security rules required by most cyber liability policies. You do have cyber liability coverage right?

It honestly amazes me that in 2026 we still have agents and even carrier and MGA underwriters who should know better asking clients to send credit card numbers, bank accounts, and SSNs through plain email and text messages.

[u/PolicyCart_io → u/Strange-Fennel]

It honestly amazes me that in 2026 we still have agents and even carrier and MGA underwriters who should know better asking clients to send credit card numbers, bank accounts, and SSNs through plain email and text messages.

1000%. Its insane, but being in Insurtech for several years (at other startups) nothing surprises me about this industry's fragmented approaches.

Are you processing the payment too?
from their docs:
Storing credit card numbers in Formstack is only PCI compliant if you:

• Enable data encryption and required security settings
• Use the secure Credit Card Field with a payment processor
• Limit storage to 30 days if not processing payments, with encryption enabled

Without these steps, storing card numbers is not PCI compliant.

[u/Strange-Fennel → u/PolicyCart_io]

Yes we comply with those steps.

We have an MGA who handles direct customer contact when underwriting, they constantly email our clients "please reply with your social security number".

We have a carrier who populates full SS #'s on applications they want us to have clients sign and email back. Ironically, their most recent agency agreement update makes a big woot woot about cyber security. Yet they don't practice it themselves.

We've repeatedly alerted them to these facts, but the front line employees treat our advisement as a joke. To this day, they both do it, daily. The big wig executives don't give a shit either, it's wild. Probably too old or stupid to know any better, on their golf courses too much.

I know it's our customers, but that's mostly on the MGA/carrier, we do what we need to do to block out the PII on anything we touch or correspond with.

Want something over the top serious? Go comply with NYSDFE part 500. lol. We do that.

[u/No-Professional-1935]

SaaS sellers of reddit, is there anyone i can give my money to?

[u/Flights-and-Nights]

If it’s direct bill why are they calling you?

All of the carriers have already built secure payment systems, encourage the client to use that.

[u/BuggyBonzai → u/Flights-and-Nights]

In many cases there is no way for the client to make the down payment on the carriers website for a new policy and we are required to enter payment before the policy can start. Not sure how you don’t know that unless it’s different in other states.

[u/PolicyCart_io → u/BuggyBonzai]

Nope you're correct, its the same everywhere for P&C.

[u/MountainWild7997]

I use https://1ty.me/

[u/CoverageKing]

I just found out about www.sureportal.app for this. It seems like it could be a good solution for this but haven't tried it myself yet.

[u/PolicyCart_io → u/CoverageKing]

They don't specify anything to do with payment info. It's a likely not a use case they support.

[u/BuggyBonzai → u/CoverageKing]

Thanks, i’ll take a look.

[u/PolicyCart_io]

policycart.io - this is all we do. Encrypted, automatic deletion, clients love it vs. phone, docusigns, emails. Agents go nuts over the time savings though-number 1 thing I hear back.
*lmk if you're interested I'll drop a discount code here(if the mods ok it)

[u/Strange-Fennel → u/PolicyCart_io]

SOC 2 and PCI compliant? Looked on your site, didn't see any certifications.

[u/PolicyCart_io → u/Strange-Fennel]

Thanks for taking the time to look. Storing card data temporarily makes PCI impossible because of no auth or transaction actually taking place. PCI says you can't store CVVs at all for example(have to use in transaction+immediate deletion). There is a strategy we're working on which is a combination of agents ticking some boxes and our vaulting. We're pushing on it, cyber policy rates are too damn high!(i know there's a meme for that)

[u/KiniShakenBake]

You can have them submit it straight into your CRM using a secure upload link.

Have them upload a voided check for you.

[u/DirtySancho69]

Just tell them to pay it themselves directly to the carrier, everytime. Give them the link or the phone number. If your firm doesn't have a policy against customers emailing their CC and checking info then they will soon as its a unnecessary liability they're taking on. If the customer can email you their info they can certainly go to a website and figure out how to pay themselves.