Your data lives in Australia.

All client records and documents live in Australia. Our database and application servers run in Sydney; document storage is pinned to Australian-only locations. Edge protection runs across a global network with TLS terminated at the closest Australian point of presence.

Yes. All data is encrypted in transit with TLS 1.3 and encrypted at rest using industry-standard authenticated encryption. Sensitive personal fields like passport numbers, dates of birth and family details are additionally encrypted using a key unique to your organisation - so even at the database layer, your data is sealed off from every other tenant.

Operationally, the encryption keys for your organisation are derived such that ImmiIQ staff cannot read your sensitive client fields by querying the database. Engineers run on a least-privilege model; production access is logged and audited. We do not use your customer data to train AI models - the AI model that powers Harper runs inside our own AWS Sydney VPC with read-only weights, so there is no training feedback loop, and no third-party AI provider receives your data.

Sign-in is passwordless. We email a one-time magic link to your registered address; the link expires in 10 minutes and can only be used once. Sessions last 24 hours and only one active session per user is allowed - if your laptop is stolen and signed in elsewhere, you can sign out everywhere from any device. We rate-limit aggressive attempts and lock out accounts that look brute-forced. Every sign-in attempt is recorded with device and country in your personal security log.

Yes. Enterprise organisations can configure an IP allowlist - sign-ins from any other address are rejected and logged for audit. Useful for firms operating from a fixed office network or VPN.

Yes. Every Pro plan includes per-member access control across three axes. Data scope limits which client records a member can read - all clients, only their team's clients, or only clients they're personally assigned to. Module access lets you switch off any of ten surfaces per member (clients, cases, communications, AI, documents, invoices, reports, billing, settings, team management). Role templates let admins build a Finance or Client-Service role once and apply across the team. All restrictions are enforced at the database layer, not just the UI - a direct API call returns the same restricted set the user sees in the app, and the AI assistant honours the same scope on every tool call. More on team permissions.

No. Strict tenant isolation is enforced on every Harper request. Harper only ever sees clients that belong to your organisation. Every tool that touches client data verifies ownership before reading; cross-organisation attempts are rejected and recorded. Harper is also instructed to refuse to speculate when its tools return no data, so it cannot 'invent' details about a client it has not been authorised to see.

Harper is opt-in - you only invoke it when you open the AI panel and submit a prompt. When you do, the prompt plus any client or case context you explicitly attach is processed inside ImmiIQ's own AWS Sydney VPC (region ap-southeast-2). Your data does not leave that region and is not sent to any third-party AI provider - no OpenAI, no Anthropic, no Google AI. The model runs on read-only weights inside our VPC, so there is no training feedback loop; your prompts can never influence the model's behaviour for other customers. Our mobile applications do not connect to any AI provider directly - the mobile app talks only to our servers, and AI inference is handled in our backend. Per-organisation AES-256-GCM encryption protects your at-rest data independently of any AI processing. Full breakdown, including what is and is not processed, is in our privacy policy.

ImmiIQ operates under the Australian Privacy Principles (APPs). Personal information is collected only as necessary to provide the service, used only for the disclosed purposes, and stored on infrastructure pinned to Australia. Our full privacy policy covers collection, retention, breach notification, access and correction rights.

Yes - a small set of established cloud providers, all configured to keep your client data in Australia. The full list, their roles and Australian regions is available on request for procurement reviews.

Account owners can export every client record, communication, document and audit log at any time from the in-app export tools. On account closure we honour deletion requests in line with our retention policy and the Australian Privacy Act - typically within 30 days, with explicit confirmation. Backups age out on a defined retention schedule.

We follow the Notifiable Data Breaches scheme under the Privacy Act 1988. If we believe a breach is likely to result in serious harm, we notify affected customers and the Office of the Australian Information Commissioner (OAIC) without undue delay. Internally we run incident-response runbooks for triage, containment, eradication and post-incident review. Our security contact for responsible disclosure is [email protected].

On request after cancellation, we delete your live data within 30 days. Encrypted backups age out within a further 90 days under the standard backup retention schedule. Audit-log entries required for legal/compliance purposes (e.g. who accessed what, when) are retained for 7 years per Australian record-keeping standards, then deleted.