Scope and certification position

The entity

Legal entity	Insurance Service Holdings Pty Ltd, trading as With Pocket
ABN	36 612 629 295
ACN	612 629 295
AFSL	491165
Registered address	Suite 1, Level 6, 171 Clarence St, Sydney NSW 2000
Code of practice	Insurance Brokers Code of Practice — binds directly, NIBA membership. General Insurance Code of Practice — reaches Pocket contractually, as a partner flow-down. Not a GICOP signatory
External dispute resolution	AFCA — Pocket is a member

What this pack covers

Pocket’s controls across two environments that are governed differently and should not be confused:

• The platform — the application that quotes, prices and binds risk, its database and its hosting on Render in the Singapore region, with the Insight MCP services on Fly.io in Sydney. Built in-house and operated by Pocket. Client records are held overseas — see Data Privacy §6.
• Corporate IT — laptops and mobile devices, endpoint security, mail filtering and SaaS backup. Delivered by Simply IT as an Agent Zero Group service, under a group contract to which Pocket is not a party.

Both facts are stated together, in the Information Security Policy and here, so that a reader does not have to work out which is which.

What independence means here

Pocket is part of Agent Zero Group, which owns both Pocket and Agile Underwriting Services. Independence in this pack means technology and capacity, never ownership:

• Independent — the platform, built in-house, sharing no code, infrastructure or data with Agile or PBA; and Pocket’s own capacity relationships.
• Shared — corporate IT, delivered by the group’s managed service provider.

The intra-group relationship is a conflict of interest, and it is managed and disclosed rather than denied. See Conflicts of Interest.

Regulatory position

Pocket is not regulated by APRA and is not directly subject to CPS 234 or CPS 230. Those obligations sit with insurers and reach Pocket contractually, as a material service provider, through a binder or service agreement. The CPS 234 references in each document’s metadata record the insurer obligations these controls are designed to support — not a standard that binds Pocket directly.

Two codes apply to Pocket, by different routes. The Insurance Brokers Code of Practice binds Pocket directly, through NIBA membership — it is the code that binds Pocket as a broker. Obligations under the General Insurance Code of Practice reach Pocket contractually, as a flow-down under the agreements signed with insurer and MGA partners — the same structure as the CPS 234 flow-down above, and the ordinary way a non-signatory comes to be bound by an industry code.

Saying both is more accurate than saying either. Pocket is not a GICOP signatory and does not present itself as one.

Certification

Pocket holds no ISO 27001 certification and no SOC 2 report. No certification held by Agent Zero Group or Agile covers any part of Pocket’s environment — their scope does not extend to Pocket’s independently built platform, and no such certification is referenced, implied or inherited anywhere in this pack.

Certification is not currently a requirement for Pocket. We operate a documented control set with named owners, evidence and annual review, set out in this pack.

Pocket does not claim to be “ready for” or “eligible for” certification. That claim invites a request for a defined scope statement, a Statement of Applicability, a risk methodology, an internal audit programme and management review minutes — none of which Pocket operates. Saying so plainly is more useful to a reviewer than a claim that would fail on the first question.

For the same reason, this pack describes no information security management system. The controls are real and the documents are real; naming an ISMS would imply machinery that does not exist.

Status of this pack

All fourteen documents are at draft. None has been approved under the Document Control Policy, which requires a named approver, a date, a commit and a content hash — an approval tied to exact content rather than implied by a field.

Several documents carry clauses that will only become Implemented when their evidence is first produced. The evidence register records the state of each artefact, and it should be read alongside this pack rather than assumed to be complete.