Goosehead Insurance

Goosehead Insurance is an independent insurance agency that shops policies across many carriers for its clients. One of its agencies needed a safe way for agents to take a client's credit card or bank account details, keep them on file, and pull them up again when it was time to charge.

We scoped the tool in February 2024, built it in March and had it in production on the agency's own domain on March 27.

Card numbers and bank details should not sit in email or in an agency's management system. The agency had chosen Basis Theory, a tokenization service, to hold that data, but had no developers to connect it to anything.

The rules were specific. An agent enters card or ACH details for a client, sometimes both. Later, a different agent needs to see them once to process a payment. The CVV has to be destroyed as soon as it is revealed, while the rest of the card stays on file so it can be charged again after the CVV is collected again.

It was an internal tool, so a plain interface was fine. We proposed building it with no server of its own, so there would be nothing for the agency to host or patch beyond a set of static files.

Card and ACH forms on Basis Theory

We wireframed the tool, then built one page with three modes: Credit Card, ACH and Reveal. The card and bank fields are Basis Theory's secure input fields, so the numbers go straight into Basis Theory's vault. Each save returns a token, and the agency keeps the token instead of the card or account number.

Validation that tells agents what is wrong

Required fields are marked, and each one explains its own error: a missing or incomplete card number, a CVV that is not three or four digits, an expiry date in the past, a routing number that is not nine digits. Save stays disabled until the form is valid, Reveal stays disabled until a token is entered, and switching modes clears old values and messages.

Reveal once, then delete the CVV

Entering a token shows the stored details. For a card, the tool then deletes the CVV from the vault and tells the agent to copy it before leaving the page. The name and card number stay on file for the next charge.

No backend to run

The whole tool is static HTML and JavaScript. We hosted a staging copy for review, then set up production in the agency's own AWS account on Amazon S3 and CloudFront, with an HTTPS certificate on the agency's domain.

Support after launch

In June 2024 Basis Theory retired the type of API key the tool used, with a July 16 deadline. We swapped in a new key, tested it on staging and released it to production the same day, three weeks ahead of the cutoff.

• Agents take card and ACH details on one page, and the numbers are stored in Basis Theory's vault, not in the agency's own systems.
• CVVs are deleted from the vault as soon as they are revealed.
• Live on the agency's domain about two weeks after development started, with no server to maintain.
• API key change handled three weeks before Basis Theory's deadline.