For Canadian P&C and life brokerages
Managed IT Services for Insurance Brokerages in British Columbia
Applied Epic, Power Broker, SIG, or Broker's Workstation: if it stalls, you can't quote, service policies, or pull eDocs from carriers. We harden, back up, and monitor the systems your licence depends on, and we test the restore before you need it.
- 81+ Google reviews
- ~15-minute response time
- No contracts, month to month
- Microsoft Partner
Your BMS needs IT that knows how brokers work.
Your BMS holds client files with SINs, banking and void cheque details, drivers' licences, and dates of birth. That is the sensitive information that triggers PIPEDA breach reporting if it gets exposed.
A ransomware hit or one clicked phishing email can lock or copy that database. When that happens, the principal broker is the one who reports to the Privacy Commissioner and notifies clients.
Carrier connectivity through CSIO eDocs, eSlips, and EDI download breaks when a VPN or BMS integration is set up wrong. Shared logins make it hard to prove who opened which client record during a council audit or a breach review.
Most brokerages assume the BMS backup works. It is rarely tested with a real restore, so a failed restore is found during an actual outage, which is the worst time to find it.
Worth knowing before your next council audit or backup scare
A few things we see brokerages get wrong, with plain answers. This is general information from an IT company, grounded in OPC and FINTRAC guidance.
-
Myth: storing client data on US servers is illegal in Canada
It isn't. PIPEDA has no data-residency rule and does not ban US or foreign hosting. The OPC treats it as a transfer for processing: you stay accountable, need contracts that ensure comparable protection, and should be transparent that data may be processed abroad. The defensible practice is strong contracts, encryption, access controls, and tested backups, not panic about server location. If you're in Quebec, Law 25 adds a privacy-assessment step for transfers outside the province.
-
You keep breach records even when you don't report
PIPEDA requires you to keep records of ALL breaches of security safeguards for at least 24 months, whether or not they meet the reporting threshold. The records need enough detail for the OPC to verify compliance, and the OPC can ask to see them. A breach that didn't need reporting still needs a record.
-
What actually triggers a report
Since November 2018, you must report a breach to the OPC and notify affected individuals when there's a 'real risk of significant harm.' That's assessed on how sensitive the information is and how likely it is to be misused. Client files full of SINs and banking details sit high on the sensitivity scale, which is worth keeping in mind.
-
Following your own retention policy is part of the law
PIPEDA Principle 5 asks you to set retention periods and to securely destroy or anonymize personal information once you no longer need it. Failing to follow your own retention policy is itself a PIPEDA issue. A policy you wrote and never use can put you offside.
-
AML duties depend on whether you do life
Under FINTRAC and the PCMLTFA, life insurance companies, brokers, and agents are reporting entities with client ID, record-keeping, and reporting duties. Pure P&C brokerage activity is generally not captured by these FINTRAC obligations, so don't assume AML rules apply to a P&C-only shop. FINTRAC updated some client-ID and record-keeping requirements effective October 1, 2025 [[verify]].
-
A backup that's never restored is a guess
Backups running on a schedule feel safe, but the only proof they work is a real restore. Many brokerages discover a failed restore during an actual outage. Testing the restore on a schedule, and timing it, is worth doing before you need it.
Umbrella IT Services is an IT company, not a law firm, accountant, or compliance advisor. This is general information, not legal or professional advice. Confirm your specific obligations with your provincial council and a privacy professional.
Sources
- OPC: Mandatory reporting of breaches of security safeguards (PIPEDA)
- OPC: PIPEDA Principle 5, Limiting Use, Disclosure, and Retention
- OPC: Guidelines for processing personal data across borders
- FINTRAC: Record keeping for life insurance companies, brokers and agents
- RIBO: Registered Insurance Brokers of Ontario
What makes us different
We test restores, not just backups
A backup that has never been restored is a guess. We run real restore tests of your BMS data so you know it will come back, and roughly how long it takes.
No long contracts, no onboarding fee
Month-to-month agreements. We earn the next month. There is no setup fee to get started and no junior tech learning on your account.
11-minute average response time
When quoting stops or eDocs won't download, you reach a real technician fast. Our average first response is about 11 minutes.
Access records you can show an auditor
We move you off shared logins to named accounts so you can show who accessed which client record. That helps with council audits and any breach investigation.
A written policy program, led by a former security officer
About 178 written policies covering retention, access, and breach records, with a former IDF security officer leading security. It gives you a system to track the records PIPEDA expects.
Quarterly reviews with a vCIO
Every quarter we sit down, review what broke and what changed, and plan ahead. You get a roadmap and a plan for next quarter.
What we do for brokerages
We focus on the few systems that, if they fail, stop the whole office. We harden your BMS and the local IT around it, set up backups we actually restore-test, monitor for the signs of ransomware and account compromise, and keep your carrier connectivity working. If you need to move BMS or email, we run the migration ourselves.
- BMS hardening and monitoring for Applied Epic, Power Broker, SIG, and The Broker's Workstation
- Backups with scheduled, documented restore tests of your BMS data
- Named-account access and login records to support council audits and breach reviews
- Carrier connectivity support: CSIO eDocs, eSlips, My Proof of Insurance, and EDI download
- Microsoft 365 with Canadian data residency, hosted in Microsoft's Toronto and Quebec City datacentres
- White-glove email and data migrations with a no-downtime guarantee. Project pricing [[verify]], plus 30% off projects and labour
Results you can measure
The Broker IT and Privacy Checklist: 9 Things to Check Before Your BMS Fails
Let's look at your BMS together.
Book a 20-minute call with Jake. We'll talk through your BMS, your backups, and what a breach would actually cost you to report. No pressure, no junior tech, no contract to sign first. If we're not the right fit, we'll say so.