Skip to main content
These laws are non-negotiable. Continuous integration fails the build if they are violated.

​
1. No GCLID mixing

Attribution writes must never mix Google Click IDs across unrelated sessions or sources. Every attribution path calls the integrity check before write.

​
2. BigQuery before CRM

BigQuery is the event truth. On every lead action, the platform writes to BigQuery before any CRM side effect. CRM is a projection, not the source of record.

​
3. PII boundary (sha256)

Personally identifiable information is hashed or redacted before it leaves the server on non-allowlisted paths. Raw PII may only leave through explicit, audited delivery paths (for example telephony or CRM delivery) with destination, purpose, and field allowlists.

​
4. Agency books (Law 4)

The agency keeps its own books for every quote: name, contact, consent, line of business, quoted premium, bound premium, bind date, and carrier. Those figures are what the producer recorded. Never automate a pull from PolicyCenter, BillingCenter, or AmFam CRM. Never collect SSN, bank account, card, or policy documents. Driver license number and date of birth stay on the call record only. Never read either back in full. Never put them in Slack, Sentry, or logs. See also: Two Environments.