The system your agency runs on.

Thomas turns the reports your office already downloads into a single source of truth for renewals, retention, and production. One system instead of several that never quite agree, so the whole agency works from the same facts, on a platform built from the ground up to protect customer and agency data.

Currently invite-only

What it does

Built from the reports, not around them

Six screens, one set of facts. Every number in Thomas comes from the same reports, so nobody has to reconcile one tool against another.

Renewals

Know which renewals are at risk before they lapse. Every upcoming renewal in one list, sorted by who needs a call first, so nothing slips through between reports.

Retention

A clear board for the customers you are working to keep. Cancellations arrive on their own, saves are credited to the person who made them, and the whole team sees the same picture.

Customers

One record per household, across every line and every year. Policies, renewals, and every conversation in one place, so anyone in the office can pick up where the last person left off.

Production

Written business against your goals, by producer and by source, with growth measured the way your carrier measures it. One set of numbers the whole agency can agree on.

Book health

Policies and items in force, premium, and retention, month by month. The state of the book at a glance, and the trend the owner actually watches.

Compensation

Build your comp plan once and let Thomas run it. Pay is calculated from confirmed business, chargebacks included, and each producer sees exactly one statement: their own.

Security

Your book never shares a database with another agency

Most agency platforms are multi-tenant: every customer's data lives in one large database, separated by software rules. Thomas takes the stricter path. Each agency is provisioned as a physically separate deployment, and the operator has no login to it: only the agency's own people are admitted at the door. There is no shared database in which a software defect could ever expose one agency's book to another.

We store less on purpose

Policy documents are read in your browser and only the fields Thomas needs are kept; the PDF itself is never uploaded. Carrier exports carrying whole-book dates of birth, phone numbers, and coverage details are deliberately not ingested.

Responses shaped by role

The API returns only the fields a person's role may see. Sensitive columns are never sent to the browser and merely hidden. Financials are visible to the owner alone, enforced on the server for every request.

Two doors, both yours

A zero-trust access layer in front of every deployment admits only the email addresses the agency names. Behind it, each teammate signs in with their own account, with view or edit access granted screen by screen. Absence of a grant means no access.

Revocable sessions

Changing or resetting a password immediately ends every other session on that account. Disabling an account cuts off its access at once, including sessions already signed in.

Guarded administration

Owner privileges cannot be granted, seized, or exercised through a support "view as" session. Every privilege boundary is enforced server-side and re-verified at each audit.

Accountable actions

Work is attributed at write time, who saved a customer, who uploaded a file, who changed a record, in append-only logs that a later edit cannot silently rewrite.

AI with a data boundary

The assistant is enabled per agency and an agency runs fully without it. When it is on, contact details are stripped before the AI sees a record, its model and tools are fixed on the server, and API traffic is not used to train models.

Built to prove what happened

Every agency database supports restoration to any moment in the last 30 days. Uploaded reports are archived byte-for-byte, so any derived figure can be traced to its source document. Every release is versioned, and the running version is visible in the product.

Authenticated integrations

Inbound email ingestion verifies its senders, delivery webhooks require cryptographic signatures, and automated sends are rate-capped. Machine credentials are scoped so no agency's deployment can read another's data, by construction, not policy.

In place today
  • Internal security audits (August and September 2026): every API route's authorization verified, injection and cross-tenant review, session and privilege boundaries tested before the first agencies went live
  • Isolated per-agency infrastructure: no shared database, no shared keys, no operator login
  • Encryption in transit and at rest, with a hardened browser security policy that blocks data exfiltration paths
  • Fail-closed configuration: a misprovisioned deployment refuses to serve rather than serving openly
On the roadmap
  • Independent third-party penetration test, with results available to customers under NDA
  • SOC 2 examination (Type I, then Type II) as customer requirements call for it
  • Formal written information-security program packaged for customer due-diligence files
  • Published vulnerability-disclosure policy

Agencies in the states that have adopted the NAIC Insurance Data Security Model Law must perform due diligence on service providers and obligate them contractually to protect nonpublic information. Thomas AMS is built to make that easy to satisfy: we will complete your security questionnaire, provide this overview for your vendor file, and contractually commit to appropriate administrative, technical, and physical safeguards, including breach notification to your agency without undue delay.

When an agency leaves Thomas, its data leaves with it: exports are provided on request, and the agency's entire isolated stack, database included, is deleted. There is no commingled data to untangle.

Availability

Currently invite-only

Thomas AMS is being rolled out to a small number of agencies at a time, each one set up and walked through personally. Invitations are extended directly by the Thomas AMS team; a way to request one from this page is coming.

Request an invitation