Certificate of currency requests and AI data leakage: what a certificate email gives away in ChatGPT or Claude.

A certificate of currency request is a routine email, and one of the most common drafts to hand to ChatGPT or Claude. The client has won a contract, the head contractor wants proof of insurance, and the broker asks the insurer to issue certificates naming the right parties. The email often drags in more than the request: the contract, the limits the contractor demands, the client’s earlier problems and the broker’s advice on how to answer pre-qualification questions. This page marks every item in a realistic request that the Code of Practice and the Privacy Act bear on, and shows how it is drafted on Ermos inside the brokerage.

The certificate of currency request

Sent when a client signs a contract with an insurance clause and needs certificates for the other party, usually with a deadline before work starts.

An invented email. The policy number is a placeholder. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the brokerage

1. 1
   The client and the policy

   The company and its policy reference. Ties the request to one business and one policy, and a policy number is the key insurers use to find a policy. Privacy Act guide.

2. 2
   The contract and the counterparty

   A named head contractor, a project, a contract value and a start date. Commercial information about a contract the client has won and the other party may not have announced.

3. 3
   The cover required and the cover held

   The limits and extensions the contractor demands compared with what the client holds. A certificate of currency is described by insurers as evidence that insurance is in force, so the comparison is where a gap would be found.

4. 4
   The interested party and the related landlord

   A second certificate naming a landlord that is a related entity of the director. Related-party information. The landlord’s interest belongs on the certificate; the draft behind it belongs inside the brokerage. Privacy Act guide.

5. 5
   The workers compensation lapse

   A short lapse in cover and the broker’s decision not to describe it as continuous. Honesty and integrity in the Code of Practice (clause 3.1) sit behind that decision, and the information itself is one of the client’s worst facts.

6. 6
   The pre-qualification advice

   A reminder to the client of an open liability claim and a regulator notice, to be disclosed to the contractor. The client’s own answer to give, and a regulator’s action against a named business.

7. 7
   The renewal terms not yet accepted

   A premium figure and the broker’s instruction not to certify the renewal until the client confirms in writing. Confidential commercial terms, and a limit on what the broker may certify.

8. 8
   The contractor’s contact

   A named contracts administrator and the role. Personal information about someone who is not the brokerage’s client. Privacy Act guide.

9. 9
   The broker

   Ties the request to a named account manager bound by the Code of Practice.

10. 10
    The standard request wording

    A polite request for anything further and a line that certificates are for information only. Generic wording found in any such email, with no client data in it.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the brokerage no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in insurance brokerages.

Common questions