Is Your Client Data Safe Offshore? NPI, SOC 2 & What to Demand from a VA Provider

The first question most agency owners ask about an offshore virtual assistant isn’t about price. It’s “Is my clients’ data safe?” That is the right question. A VA working in your agency will see dates of birth, driver’s license numbers, bank details, loss histories and, on benefits accounts, employee census files. Offshore data security is the number one objection to outsourcing, and it deserves a straight answer.

This guide explains what counts as client nonpublic personal information (NPI), what the law expects of your agency when a vendor handles it, what a SOC 2 report does and doesn’t prove, and the checklist to use with any VA provider before you share a single login.

What Counts as Client NPI at an Insurance Agency

Under the Gramm-Leach-Bliley Act (GLBA), nonpublic personal information is personally identifiable financial information that a consumer provides to a financial institution, that results from a transaction or service, or that the institution otherwise obtains. Publicly available information is excluded. Insurance agencies fall within that definition.

In practice, almost everything in your agency management system qualifies:

• Names linked to policy numbers, premiums and payment history
• Dates of birth, driver’s license numbers and motor vehicle records
• Social Security numbers on applications and benefits enrollments
• Bank account and card details used for premium payments
• Claims and loss history
• Employee census and enrollment data on group benefits accounts

Benefits work can add health information to the mix. If your agency acts as a business associate of a group health plan, HIPAA obligations may also apply. Either way, any offshore data security plan has to assume the VA will touch sensitive data every day.

What the Rules Say About Offshore Data Security

GLBA and Your State Insurance Regulator

GLBA requires regulators to set administrative, technical and physical safeguards that protect the security and confidentiality of customer records. For anyone providing insurance, those rules are enforced by the state insurance authority, not a federal agency.

Most states built their rules on two NAIC models: the Privacy of Consumer Financial and Health Information Regulation (Model 672) and the Standards for Safeguarding Customer Information Model Regulation (Model 673). Model 673 explicitly expects licensees to oversee their service provider arrangements. In other words, outsourcing a task doesn’t outsource the responsibility, and offshore data security sits squarely on your agency’s list.

State Insurance Data Security Laws

The NAIC Insurance Data Security Model Law (Model 668) goes further. A licensee covered by it must maintain a written information security program based on a risk assessment. Section 4F requires the licensee to exercise due diligence in selecting a third-party service provider and to require that provider to “implement appropriate administrative, technical, and physical measures” to protect the information it can access. Cybersecurity events that meet the model’s criteria must be reported to the commissioner within 72 hours of determining they occurred.

According to the NAIC adoption map, 28 jurisdictions (27 states plus Puerto Rico) had adopted a version of the model as of August 2026. State versions differ. The model exempts licensees with fewer than ten employees, including independent contractors, from the information security program section, and some states apply their law only to insurers rather than agencies. Check your own state’s version before deciding what applies.

New York’s Cybersecurity Regulation

If you are licensed in New York, 23 NYCRR Part 500 adds specific requirements. Section 500.11 requires written policies for the security of systems and data accessible to third-party service providers. Section 500.12 requires multi-factor authentication for any individual accessing a covered entity’s information systems, with narrower rules for entities that qualify for a limited exemption. Incidents must be reported within 72 hours of determining they occurred.

Going Offshore Doesn’t Change Your Data Security Obligations

None of these rules ban offshore service providers. What they require is that you choose providers carefully, set security expectations in writing and keep overseeing them. Offshore data security is therefore a vendor management question, not a geography question.

If your provider is based in India, it also falls under India’s Digital Personal Data Protection Act, 2023, whose implementing rules were notified in November 2025. Data of people outside India processed under a contract with a foreign client is largely exempt from the Act, but the duty to take reasonable security safeguards to prevent a personal data breach still applies, with penalties of up to ₹250 crore for failing to do so. That is a useful backstop, but your agency’s own requirements should always be the standard.

The Real Offshore Data Security Risk Isn’t the Ocean. It’s Access.

Breaches rarely happen because data crossed a border, which is why offshore data security is mostly about controls. They happen because someone had access they shouldn’t have, or used it carelessly.

• Verizon’s 2025 Data Breach Investigations Report found that breaches involving a third party doubled from 15% to 30%, while the human element was involved in around 60% of breaches.
• IBM’s 2025 Cost of a Data Breach report put the average cost of a breach in the United States at a record $10.22 million, against a global average of $4.44 million.
• The FBI’s Internet Crime Complaint Center recorded about $2.77 billion in losses to business email compromise in 2024.

Those numbers point to the controls that matter: who can log in, from which device, with what authentication, and whether anyone notices unusual activity. A temp in your own office using a producer’s shared password is a bigger risk than a well-controlled offshore assistant with a named login and MFA. Good offshore data security comes down to access control, device control and oversight.

SOC 2, ISO 27001 and Other Offshore Data Security Badges

What a SOC 2 Report Actually Is

SOC 2 is an examination performed by an independent CPA firm under AICPA standards. It reports on a service organisation’s controls relevant to the five Trust Services Criteria categories: security, availability, processing integrity, confidentiality and privacy. It is an attestation report, not a certificate, so “SOC 2 certified” is marketing shorthand.

There are two types. A Type 1 report looks at whether controls are designed properly at a single point in time. A Type 2 report also tests whether those controls operated effectively over a period, typically six to twelve months. For a provider that will handle your NPI every day, Type 2 is the stronger evidence.

If a provider claims SOC 2, ask to see the report under a confidentiality agreement and check four things:

• Scope: does it cover the services and locations your VA will actually work from?
• Period: is it recent, and does it cover a meaningful length of time?
• Exceptions: what did the auditor find, and how was it fixed?
• Your responsibilities: the report will list complementary controls your agency is expected to run, such as MFA and access reviews.

ISO/IEC 27001

ISO/IEC 27001 is the best-known international standard for information security management systems. Organisations are certified by independent certification bodies, not by ISO itself. Ask for the certificate and its scope statement.

What a Badge Doesn’t Tell You

A report or certificate tells you a provider has a security programme for offshore data security in general. It doesn’t tell you how your VA’s access to your AMS and carrier portals is set up. That part is shared between you and the provider, and it is where most real-world risk sits.

Offshore Data Security Checklist: What to Demand From a VA Provider

Use this checklist in every vendor conversation. A provider that takes offshore data security seriously will answer each point with specifics.

People

• Background checks before hire
• A signed confidentiality agreement for every VA
• Security awareness training on hire and at least annually
• No commission-based pay, which also keeps VAs on the unlicensed side of the line

Devices and Premises

• Company-managed computers with full-disk encryption
• Mobile device management with remote wipe
• Endpoint detection and response or antivirus software on every device
• A device-free work floor, so personal phones can’t photograph screens
• Badge access and on-site security

Access

• A named login for each VA in your AMS and every carrier portal
• Multi-factor authentication everywhere it is available
• Least-privilege permissions, so the VA can do the job and nothing more
• A business password manager instead of passwords in email or spreadsheets
• Same-day removal of access when a VA leaves your account

Monitoring and Testing

• Regular vulnerability scanning and prompt patching
• Periodic penetration testing
• Activity logs or a dashboard showing what the VA did and when

Contract and Paper Trail

• Written security and confidentiality obligations
• A breach notification commitment fast enough for you to meet any 72-hour regulatory deadline
• The right to request evidence of controls, such as a SOC 2 report or policy documents
• Rules on subcontracting, and return or deletion of your data when the contract ends

Business Continuity

• Redundant internet connections and backup power, so a local outage doesn’t stop your service desk

Your Side of Offshore Data Security: Controls Your Agency Owns

A provider’s controls only cover half of the offshore data security picture. Before a VA starts:

• Set up AMS access properly. Create a named user in a restricted security group. Our Applied Epic workflow guide shows how this works in one system.
• Give carrier portal logins to the VA, not to the team. Check each carrier’s portal terms on user accounts, and never share a producer’s credentials.
• Turn on MFA for email and your AMS. Business email compromise is one of the most expensive crimes reported to the FBI.
• Update your written information security program. List the provider as a third-party service provider and record the due diligence you did.
• Tell your E&O and cyber carriers. Some policies ask about outsourced staff and vendor controls.

Our guide on how to onboard an insurance virtual assistant includes a secure access setup for the first week. For the link between overloaded staff and errors, see Why Your Agency E&O Risk Goes Up When Your CSR Is Overwhelmed.

How XAssure Handles Offshore Data Security

XAssure was built to handle insurance agency data, and its security and compliance controls cover each part of the checklist:

• Threat and vulnerability management: endpoint detection and antivirus software, weekly vulnerability scanning, monthly patching with out-of-band fixes, and annual penetration testing
• Identity and access management: least-privilege access, multi-factor authentication and role-based permissions
• People security: background checks and cybersecurity training on hire and every year
• Data security: BitLocker encryption on all computers, mobile device management with remote wipe, encrypted communications and a zero-trust architecture with device isolation
• Physical security: a device-free work environment with lockers, badge access and 24/7 security guards
• Business continuity: redundant network connections and on-site generators at each site
• Credential handling: carrier portal logins managed through LastPass or 1Password

On top of the controls, every VA’s work is logged in a live dashboard with real-time task timers, so you can see exactly what was done on your accounts and when.

Summing Up

Offshore data security comes down to three things: knowing what NPI you hold, meeting your own obligations to oversee service providers, and choosing a VA provider whose controls you can verify. GLBA, state data security laws and New York’s Part 500 don’t prohibit offshore help. They require due diligence, written expectations and ongoing oversight.

Ask every provider for specifics, read any SOC 2 report carefully, and set up named, MFA-protected access on your side. When you are ready to see how a security-first insurance VA works on your own accounts, XAssure offers a 2-week free trial.

Frequently Asked Questions

Also Reads

• Why Your Agency E&O Risk Goes Up When Your CSR Is Overwhelmed
• How to Onboard a Virtual Assistant for Your Insurance Agency in Under a Week
• XAssure vs. Generic Offshore VA Firms: What “Insurance-Trained” Really Means
• Virtual Assistant vs. In-House CSR: A Side-by-Side Breakdown for Insurance Agencies
• How to Hire a Virtual Assistant for Your Insurance Agency: The Complete 2026 Guide

This article is for general information and is not legal advice.