A carrier's security team opens a request to approve a new route for outside data, and the first question is not about features. It is where policyholder data goes, who holds it along the way, and for how long.
When the route runs on a vendor's servers, every submission and claim payload leaves the carrier's controlled infrastructure. Each payload carries PII and, on many claims, PHI. The review stalls while the team traces every hop.
This article explains what it means to run an integration gateway inside a carrier's own environment, what breach and regulatory data say about third-party exposure, and how the hosting options compare. It closes with questions to put to any vendor.
What Does It Mean to Run an Integration Gateway Inside Your Own Environment?
An integration gateway is a single, secured entry point that lets outside systems send data into a carrier's core platform without building a separate connector for each sender. Running it inside your own environment means the gateway is deployed on infrastructure the carrier controls, such as its own cloud account or data center.
The carrier, not the vendor, holds the network boundary, the encryption keys, and the logs.
What the Gateway Does at the Door
Outside senders such as MGAs, TPAs, and brokers authenticate at the gateway, send a payload, and receive validation results. The gateway checks structure, routes the data toward the right policy, claims, or billing system, and records each request.
Every sender passes through one controlled entry point instead of a separate route for each vendor.
What Inside Means in Practice
Inside means the carrier's infrastructure hosts the gateway and everything it processes. Payloads sit on carrier-controlled systems, and the carrier sets retention and access rules.
The sender's own system stays outside. Data crosses once, from the sender to the carrier's boundary.
What Stays Under Carrier Control
Network rules, key management, logging, and patch schedules sit with the carrier's own teams. A security reviewer inspects each of them directly instead of reading a vendor attestation.
Why Does Third-Party Exposure Drive the Hosting Decision?
Every outside party that holds policyholder data adds an attack surface the carrier does not operate. IBM's Cost of a Data Breach Report 2025 ranks third-party vendor and supply chain compromise as the second most common initial attack vector in breaches.
What the 2025 Breach Data Shows
The report, produced by Ponemon Institute and published by IBM in 2025, studied 600 organizations across 17 industries that suffered breaches between March 2024 and February 2025. Third-party vendor and supply chain compromise started 15% of those breaches and carried an average cost of USD 4.91 million.
It also took the longest to identify and contain, at 267 days. IBM explains that these attacks are hard to detect because they exploit established trust between vendor and customer.
Why Integration Routes Carry Sensitive Payloads
A submission carries insured names, addresses, and business details. A claim payload carries loss details and, on injury claims, medical information.
A route for this data is a high-value target by content alone.
What a Hosted Route Adds to the Review
A vendor-hosted route puts payloads on a second party's systems. The carrier's reviewers add that party's access controls, staff, subcontractors, and retention practices to the list.
An in-environment route removes that party from the data path. The review covers infrastructure the carrier already governs.
How Do Regulators Treat Third-Party Data Handling?
State insurance regulators expect carriers to protect nonpublic information wherever it travels. The NAIC Insurance Data Security Model Law, adopted in 2017, applies to insurers, agents, and other entities licensed by a state department of insurance.
What the NAIC Model Law Requires
According to NAIC's August 2025 government affairs brief, the model requires licensees to maintain an information security program based on risk assessment, to investigate cybersecurity events, and to notify the state insurance commissioner of those events.
The model also phases in requirements for oversight of third-party service providers.
How Far Adoption Has Spread
As of August 8, 2025, NAIC listed 28 jurisdictions as having implemented the model. NAIC adds that its map does not determine whether each state's law contains every element of the model.
Carriers that write in several states read each state's version on its own terms.
Why Fewer Outside Holders Shorten Oversight
Third-party oversight scales with the number of outside parties that hold nonpublic information. A route that keeps payloads on the carrier's own systems adds no new holder to that list.
The carrier still documents the route and reviews the software it runs. It does not add a vendor to oversee for data that vendor never holds.
What Does Data Location Change When an Incident Happens?
Where data sits sets how far an incident spreads and how long containment takes. IBM's 2025 figures show the difference by storage location.
What the IBM Figures Show by Location
Breaches involving data spread across multiple environments averaged USD 5.05 million and took 276 days to identify and contain. Breaches of data stored on premises averaged USD 4.01 million and took 217 days, which is 59 days shorter.
What the Figures Do Not Show
IBM sorts breaches by where data was stored: public cloud, private cloud, on premises, or several of these. It does not compare integration tools or vendor hosting models. IBM also describes its sample of 600 organizations as nonstatistical.
Read the figures as evidence that fewer environments holding data narrows an incident, not as a ranking of hosting products.
Why the Carrier's Own Logs Matter
When the gateway logs every request inside the carrier's environment, the incident team queries its own systems. It does not wait on a vendor to export records.
How Do the Hosting Options Compare?
Teams weigh three hosting models for an inbound data route: a vendor-hosted shared service, a vendor-hosted dedicated tenant, and a route that runs inside the carrier's environment. The differences sit in who holds the data and who controls the safeguards.
Vendor-hosted shared service | Vendor-hosted dedicated tenant | Inside the carrier's environment | |
|---|---|---|---|
Where payloads sit | Vendor's shared infrastructure | Vendor's infrastructure, isolated tenant | Carrier-controlled infrastructure |
Who holds keys and logs | Vendor | Vendor, unless the contract says otherwise | Carrier |
Outside parties holding PII and PHI | Vendor and its subprocessors | Vendor and its subprocessors | None added |
Security review scope | Vendor attestations and contract terms | Vendor attestations and contract terms | Carrier's own infrastructure controls |
What the carrier operates | Nothing | Nothing | Hosting, patching, capacity |
What In-Environment Hosting Asks of Your Team
The carrier supplies the infrastructure and runs patching and capacity planning. That is real work.
Carriers weigh it against a shorter data-handling review and a smaller list of outside holders of nonpublic information.
Questions to Put to Any Vendor
Ask where every payload is stored and for how long. Ask which subprocessors touch the data, where the AI models run, and who holds the encryption keys.
Ask whether the logs live in your environment, and get the data flow diagram in writing.
How InsOps Helps
InsOps builds an insurance-trained AI that assists with moving submission and claims data into your core platform. LiLa, our insurance-trained LLM, drafts the field mapping from a sender's payload to your platform's structure, and a person at the sender reviews and confirms every mapping before data moves.
The InsOps Integration Gateway and LiLa run inside your own environment, so PII and PHI stay in controlled infrastructure. MGAs, brokers, TPAs, and vendors register in a self-service portal, bring their payload, and configure it without building their own connector.
A request dashboard records every request, response, and error, so the record sits in your own environment. The gateway flags incomplete data before it reaches an underwriter or adjuster, and it supports on-premises and cloud platform APIs. InsOps is a Guidewire technology partner.
If you are evaluating how to exchange submission and claims data with your core platform without moving PII and PHI outside your own infrastructure, contact us to talk through what this looks like for your operation.
Frequently Asked Questions
What is an integration gateway?
An integration gateway is a single, secured entry point that lets outside systems send data into a carrier's core platform without building a separate connector for each sender. It authenticates senders, validates payloads, and logs each request.
Why do carriers run an integration gateway inside their own environment?
Payloads that contain PII and PHI stay on carrier-controlled infrastructure, so no outside party holds them in transit. The carrier also keeps its own keys, logs, and access rules.
What does the NAIC Insurance Data Security Model Law require of carriers?
Licensees maintain an information security program, investigate cybersecurity events, and notify the state insurance commissioner. The model also phases in oversight of third-party service providers.
Does in-environment hosting remove a carrier's vendor oversight duties?
No. Oversight of the software and the route stays with the carrier. What shrinks is the data-handling review, because the vendor never holds the payloads.
What should a carrier measure to know the hosting choice is working?
Track the number of outside parties that hold PII or PHI, the time from vendor request to security approval, and the share of requests logged in your own systems. Fewer holders and faster approvals show the choice is working.
How does the InsOps Integration Gateway help?
The gateway runs inside your environment and gives senders a prebuilt route into your core platform, with LiLa drafting the field mapping. The sender's administrator confirms each draft before any data is sent.
What does in-environment hosting ask of a carrier's team?
The carrier supplies the infrastructure and handles patching and capacity planning. Build these tasks into the rollout plan alongside the security review.
How long does it take to get an in-environment route approved and live?
The carrier's infrastructure readiness and review cycle set the timeline. Start with one sender and one line of business, confirm the data flow diagram with security, then add senders. The common pitfall is onboarding senders before security has signed off on the data path.