Guides

How to check the TrustedForm certificate on an insurance lead

Updated October 4, 2026

A TrustedForm certificate is a link to a record of the web form visit that produced your lead. Checking one takes a few minutes. Keeping it takes one more step that's easy to skip.

What is a TrustedForm certificate?

TrustedForm is a tool from ActiveProspect. A lead seller adds its script to a form page, and the script records the shopper's visit. When the shopper submits the form, the seller gets a certificate, and you get its URL with the lead.

According to ActiveProspect, each certificate includes:

• The URL of the page with the form (and the parent page, if the form sits inside another page)
• The date and time of the visit
• The shopper's public IP address, browser, and operating system
• A snapshot of the page as the shopper saw it, including the consent text
• An event log of clicks, typing, and field changes, with timestamps
• A session replay that plays the visit back

What is a certificate URL, and how do you open it?

A certificate URL starts with https://cert.trustedform.com/ followed by a long code. Your vendor should send it in its own field on each lead, next to the name and phone number. Here's how that looks in a sample lead record.

Open the URL while you're logged into your own TrustedForm account. Only trust links on that domain. ActiveProspect warns against accepting screenshots or videos of a certificate, because those can be altered.

The shopper's phone and email show as asterisks at first. Type in the phone or email from your lead exactly as you received it. If it matches what the shopper typed on the form, TrustedForm reveals the values. If it doesn't match, the certificate may belong to a different lead, and you should ask the vendor before you call.

What should match between the certificate and the lead?

Work through these for a test batch, then spot-check as you keep buying:

1. Phone and email. The values appear on the certificate when you enter them, as described above.
2. Date and time. The visit time matches the consent time on the lead. A realtime lead should be only minutes old.
3. Page URL. It's an insurance quote page on a site you recognize, and the source the vendor told you about. Watch for sweepstakes, survey, job, or free-sample pages.
4. Consent text. The text on the page matches the consent text the vendor sent with the lead, word for word.
5. Who it names. The consent covers your agency, by name or through a partner list linked from the form.
6. Visibility. The consent text sits near the submit button and is easy to read. It isn't hidden, tiny, or faint.
7. Location. The IP-based location roughly fits the address on the lead.
8. Submission. The event log shows a "submitted form" event, and the replay shows a person filling out the form.

If several leads fail the same check, stop buying from that source until the vendor explains it.

What does the consent text need to say?

For sales calls and texts made with an autodialer or a prerecorded or artificial voice, federal rules require prior express written consent. On the certificate, look for wording that:

• Authorizes the seller, which should be you, to call and text the shopper at the number given
• Covers the methods you use, such as an autodialer or prerecorded voice
• Says that agreeing isn't a condition of buying anything
• Appears next to the button the shopper pressed to agree

If the text names other companies and not you, the certificate shows consent for them. For the background, read the one-to-one consent rule and TCPA risk in purchased insurance leads.

Does a TrustedForm certificate expire?

Yes, unless you retain it. According to ActiveProspect's support page on expiration:

• A certificate expires 3 days after it's created.
• If TrustedForm confirms the shopper submitted the form, that's extended to 90 days from creation.
• After it expires, the certificate is deleted and can't be retained.
• A retained certificate is stored in your account for 5 years by default.

The certificate page shows when it's scheduled to be deleted. TCPA claims can be filed up to four years after a call (28 U.S.C. § 1658(a)), so a certificate that disappears after 90 days won't help you with a claim filed next year.

For aged leads, open the certificate as soon as you get the lead, and retain it while it's still available. For more, see can you call aged insurance leads.

How to retain a certificate

There are two common ways:

• By hand. Open the certificate while logged into TrustedForm and click "Retain Certificate." This works for a test batch or a few leads a day.
• Automatically. Your CRM or lead software sends each certificate URL to TrustedForm as the lead arrives, along with the lead's phone or email for matching. Ask your CRM provider whether it supports TrustedForm.

Either way, retain it in your own account and store the certificate URL on the lead in your CRM. ActiveProspect's policy puts the job of checking consent on the company that contacts the shopper, and it doesn't let sellers hand buyers their retained copies as the buyer's record.

Watch for masked certificates. They hide the page URL, the session replay, and the event log, usually to protect the seller's source. ActiveProspect says they make weaker evidence. Ask for the standard certificate.

What a session replay shows

The replay rebuilds the page and plays back the shopper's mouse movements, clicks, typing, and scrolling in order, with timestamps. Click a time in the event log to jump to that moment. If you're ever sued, a retained certificate can be shared with your lawyer through a view-only link.

A replay can be partial if the shopper left the page quickly or the connection dropped. It also shows what happened in that browser, but it can't show who was sitting at it. Keep your own notes on each call, including any request to stop.

VeroQuote includes the certificate URL and the consent text word for word on every lead that has a TrustedForm certificate, so you can run these checks before you dial. The proof section on our homepage explains how.

This guide is general information, not legal advice.