Approval methods
An approval must come from the customer, not the agent buying for them. So before the customer can approve, they prove it’s them with a one-time code sent by SMS to their own mobile, which an agent doesn’t have.
What the customer sees
The agent passes on the link
When the purchase pauses, the agent is shown the approval link and asked to pass it to the customer.
The customer opens the link
The approval page shows your brand and is built from the product version the review uses: the price and cover summary, the key exclusions, the details the agent gave on their behalf, your policy documents, and the statements they must tick. The customer confirms each answer or says something’s wrong, opens the required documents and ticks each statement.
At any point the customer can decline instead, and say why: it wasn’t them, the details are wrong, they changed their mind, or another reason. See Decline reasons.
Bot check
The approval page is designed for human customers. A product can turn on a bot check (Cloudflare Turnstile) for the page’s actions, on its Approval settings: a browser identified as a bot then can’t answer the identity check, ask for a code or approve, so an agent that opens the link itself can’t complete the approval. The customer sees “Checking you’re a human…” while it runs.
Identity check (optional)
A product can ask the customer for one to three of the quote’s details, such as their last name and date of birth, before the page shows anything about the quote. Turn it on in the product’s Approval settings.
- If the link reaches the wrong person, they see only your brand and the questions.
- Once the answers match, that browser shows the review until it expires. Another browser is asked again.
- Approving still needs the code.
- After five wrong answers, the review expires, for the customer, for the status call and in the portal.
The identity check keeps the quote from someone who only has the link. It doesn’t prove a person is approving: whoever made the quote, an agent included, knows these details.
Limits
Codes are single use. A new code replaces the last one.
What an approval records
- When the customer approved, and how: a one-time code by SMS.
- Each statement they ticked, with the version of its wording.
- A fingerprint of exactly what they were shown: the quote, the product version and its documents.
- The bot check’s verdict on the browser that approved.
The code itself is never stored. Each review in Approvals lists every code sent and when the page was opened. It also verifies what was shown against what’s stored, shows the audit trail, and can be downloaded as a record.
Security notes
- The code goes to the mobile on the quote. If an agent puts its own number in the quote, the code goes to the agent, so check the mobile comes from the customer.
- Text messages can be intercepted, for example by SIM swap. A code shows the customer had the phone; it isn’t proof of identity.
Testing
With a test key nothing is texted: the approval page shows the code, so you can approve without a phone. See Test and go live.