Your data lives in Australia.

All client records and documents live in Australia. Our database and application servers run in Sydney; document storage is pinned to Australian-only locations. Edge protection runs across a global network with TLS terminated at the closest Australian point of presence.

Yes. All data is encrypted in transit with TLS 1.3 and encrypted at rest using industry-standard authenticated encryption. Sensitive personal fields like passport numbers, dates of birth and family details are additionally encrypted using a key unique to your organisation - so even at the database layer, your data is sealed off from every other tenant.

Operationally, the encryption keys for your organisation are derived such that ImmiIQ staff cannot read your sensitive client fields by querying the database. Engineers run on a least-privilege model; production access is logged and audited. We do not use your customer data to train AI models - the AI model that powers Harper runs inside our own AWS Sydney VPC with read-only weights, so there is no training feedback loop and no third-party AI provider receives your data.

Sign-in is passwordless. We email a one-time magic link to your registered address; the link expires in 10 minutes and can only be used once. Sessions last 24 hours and only one active session per user is allowed - if your laptop is stolen and signed in elsewhere, you can sign out everywhere from any device. We rate-limit aggressive attempts and lock out accounts that look brute-forced. Every sign-in attempt is recorded with device and country in your personal security log.

Yes. Enterprise organisations can configure an IP allowlist - sign-ins from any other address are rejected and logged for audit. Useful for firms operating from a fixed office network or VPN.

Yes. Every Pro plan includes per-member access control across three axes. Data scope limits which client records a member can read - all clients, only their team's clients or only clients they're personally assigned to. Module access lets you switch off any of ten surfaces per member (clients, cases, communications, AI, documents, invoices, reports, billing, settings, team management). Role templates let admins build a Finance or Client-Service role once and apply across the team. All restrictions are enforced at the database layer, not just the UI - a direct API call returns the same restricted set the user sees in the app and the AI assistant honours the same scope on every tool call. More on team permissions.

No. Strict tenant isolation is enforced on every Harper request. Harper only ever sees clients that belong to your organisation. Every tool that touches client data verifies ownership before reading; cross-organisation attempts are rejected and recorded. Harper is also instructed to refuse to speculate when its tools return no data, so it cannot 'invent' details about a client it has not been authorised to see.

Harper is opt-in - you only invoke it when you open the AI panel and submit a prompt. When you do, the prompt plus any client or case context you explicitly attach is processed inside ImmiIQ's own AWS Sydney VPC (region ap-southeast-2). Your data does not leave that region and is not sent to any third-party AI provider - no OpenAI, no Anthropic, no Google AI. The model runs on read-only weights inside our VPC, so there is no training feedback loop; your prompts can never influence the model's behaviour for other customers. Our mobile applications do not connect to any AI provider directly - the mobile app talks only to our servers and AI inference is handled in our backend. Per-organisation AES-256-GCM encryption protects your at-rest data independently of any AI processing. Full breakdown, including what is and is not processed, is in our privacy policy.

ImmiIQ operates under the Australian Privacy Principles (APPs). Personal information is collected only as necessary to provide the service, used only for the disclosed purposes and stored on infrastructure pinned to Australia. Our full privacy policy covers collection, retention, breach notification, access and correction rights.

Yes - a small set of established cloud providers, all configured to keep your client data in Australia. The full list, their roles and Australian regions is available on request for procurement reviews.

Account owners can export every client record, communication, document and audit log at any time from the in-app export tools. On account closure we honour deletion requests in line with our retention policy and the Australian Privacy Act - typically within 30 days, with explicit confirmation. Backups age out on a defined retention schedule.

We follow the Notifiable Data Breaches scheme under the Privacy Act 1988. If we believe a breach is likely to result in serious harm, we notify affected customers and the Office of the Australian Information Commissioner (OAIC) without undue delay. Internally we run incident-response runbooks for triage, containment, eradication and post-incident review. Our security contact for responsible disclosure is security@immiiq.com.

On request after cancellation, we delete your live data within 30 days. Encrypted backups age out within a further 90 days under the standard backup retention schedule. Audit-log entries required for legal/compliance purposes (e.g. who accessed what, when) are retained for 7 years per Australian record-keeping standards, then deleted.

OAuth tokens for connected Gmail and Microsoft 365 mailboxes are sealed with AES-256-GCM using the same per-org envelope as every other integration credential and are never logged. Gmail push events arrive as OIDC-signed Pub/Sub notifications with the audience pinned to the push endpoint URL and are dropped otherwise; Microsoft 365 change notifications carry a per-connection random clientState that is verified on every inbound call. Mailboxes are scoped per user, not per org, so an agent's mailbox never becomes shared infrastructure. Disconnecting revokes the token and blanks the sealed blob in the same transaction that closes the connection row.

Twilio and JustCall credentials are sealed with AES-GCM per-org keys before touching the database and never leave the vault module. Every provider webhook is HMAC-verified against your own connection's secret over the canonical URL and sorted-parameter form, so a forged callback from a different tenant can never write into your call history. Recording bytes are re-encrypted with a per-organisation key before they hit ImmiIQ storage and are only reachable through 5-minute signed URLs generated after a fresh org-membership check - cross-org playback returns 403 the moment the caller's active org does not match the row's organisation_id.

Twilio Messaging credentials are sealed in the same per-org integration vault (AES-256-GCM with per-org HKDF keys, identical envelope to Xero and backup destinations). Provider webhook receipts are HMAC-verified through the shared helper and deduped in the integration webhook-events table so a replay cannot double-write a delivery status. Outbound sends respect Meta's 24-hour customer-care session-window server-side; the composer UI mirrors the same rule client-side so a stale tab cannot bypass it. Freeform copy is only allowed if the client messaged in within the last 24 hours; otherwise only Meta-approved templates leave the platform.

Your firm is. ImmiIQ secures the credential vault, the webhook verification, the per-org encrypted recording copy and the audit trail on our side. What lives on the provider side - the mailbox on Google Workspace or Microsoft 365, the plaintext recording on Twilio or JustCall, the WhatsApp Business message history on Meta - is governed by that provider's own retention, access and encryption policies. Disconnecting any tile drops our sealed credentials immediately; the provider-side data stays under your control.

Yes. Every Pro plan includes bring-your-own backup - connect Google Drive, OneDrive, Dropbox or any S3-compatible bucket (AWS S3, Cloudflare R2, Backblaze B2, Wasabi, MinIO) and ImmiIQ writes a daily plaintext copy of your client and sponsor documents into a folder or bucket you own. Firms pick Archive (append-only, a delete in ImmiIQ never touches the destination copy) or Mirror (deletes propagate within about 15 minutes) and the hour of day the backup runs, in their own timezone. Your ImmiIQ-hosted copy stays encrypted with our per-organisation key regardless; the destination copy is under your firm's control, so its access policy (who can view the Drive folder, whether the bucket is public, MFA on the destination account) is your responsibility. You can disconnect at any time.