Skip to content
immiIQ

Hosted in Australia

Your data lives in Australia.

All client data is encrypted at rest in Sydney. Documents on AU-pinned storage. Every organisation gets its own encryption key. Your data is sealed off from every other tenant.

Last updated: May 2026

Arjun Mehta · passport scanExample firm

One file, from upload to the audit log

Upload
Stored
Access checked
Opened
Logged

Upload. Sent over an encrypted connection.

Arjun Mehta sends it from his client portal.

Audit log

Nothing opened yet.

One passport scan travels from the client portal to the audit log. A member without access is turned away at the gate.
SydneyDatabase region
AES-256-GCMPer-organisation keys
TLS 1.3In-transit encryption
One SessionPer user, enforced

Where your data physically lives

Every layer of the hot path runs in Australia.

Database, application servers and object storage are pinned to Sydney. Edge protection runs through a global network with TLS terminated at the closest Australian point of presence.

ComponentProviderRegion
DatabaseAWSap-southeast-2 (Sydney)
Application serversVercelsyd1 (Sydney)
Document storageCloudflare / AWSOC (Oceania, AU/NZ)
Edge / DDoS / WAFCloudflare, Vercel, AWSGlobal, AU PoPs primary

Bring-your-own backup

Keep a second copy in storage your firm owns.

Connect Google Drive, OneDrive, Dropbox or any S3-compatible bucket (AWS S3, Cloudflare R2, Backblaze B2, Wasabi, MinIO) and ImmiIQ writes a daily plaintext copy of your client and sponsor documents into a folder or bucket you own. Your firm picks the mode (Archive = append-only, Mirror = deletes propagate within 15 minutes) and the hour of day it runs, in your own timezone.

The ImmiIQ-hosted copy stays encrypted with our per-organisation AES-256-GCM key regardless. The destination copy is under your firm's control - once files land on the storage account you connect, the access policy on that side is your responsibility. Includes browsable folder tree (Clients / Sponsors / category), audit log of every connect / mode change / disconnect and one-click disconnect at any time.

Defence in depth

Six layers between an attacker and your client data.

A breach has to defeat every one of these in sequence. We build assuming the layer above will eventually fail.

1

Layer 1

Edge & Transport

Cloudflare/Global, AU PoPs primary

  • TLS 1.3 enforced (no downgrade)
  • Always-on DDoS mitigation
  • Web Application Firewall (OWASP rules)
  • Bot management, automated rate limiting
  • DNSSEC and HSTS preload
  • TLS terminated at closest AU PoP
2

Layer 2

Application Runtime

Vercel/syd1 (Sydney)

  • Serverless functions pinned to Sydney
  • Encrypted environment secrets
  • Per-deployment immutable hashes
  • Auto-scaled, no shared instances
  • HTTPS-only enforcement
  • Integrated audit log
3

Layer 3

Database

AWS/ap-southeast-2 (Sydney)

  • AES-256 encryption at rest
  • Point-in-time recovery (PITR)
  • Automated daily snapshots
  • All queries parameterised (no string SQL)
  • Per-organisation row-level isolation
  • TLS 1.3 channel-bound connections
4

Layer 4

Application Authentication

ImmiIQ/Application layer

  • Passwordless magic-link sign-in
  • Sessions expire after 24 hours
  • One active session per user
  • Brute-force protection on every account
  • Sign-in activity log per user
  • IP allowlist on request
  • Sign in with Google or Apple
  • Strict tenant isolation on every request
5

Layer 5

Per-Member Access Control

ImmiIQ/Application layer

  • Three data scopes per member: all clients / their team / assigned only
  • Ten module switches per member to lock specific surfaces
  • Named role templates with bulk apply across the team
  • Sub-team grouping with optional default role + sync
  • Restrictions enforced at the database, not the UI
  • Direct API calls return the same restricted set the user sees
  • AI assistant honours the same scope on every tool call
6

Layer 6

Per-Organisation Encryption

ImmiIQ/Application layer

  • Industry-standard authenticated encryption
  • Unique encryption key derived per organisation
  • Sensitive client data encrypted at rest
  • Search remains fast on encrypted records
  • Integration credentials and session tokens sealed
  • Key rotation invalidates every prior ciphertext

Document access

No public document URLs. Ever.

Every uploaded passport, visa letter and financial record is stored behind a server-side authorisation check. Direct URLs to documents do not exist. When an authenticated agent opens a document, ImmiIQ mints a signed URL that expires in one hour. After expiry the link is permanently invalid.

Signed URLs only

Every download generates a unique, time-limited URL. Sharing the link does not share access beyond one hour.

Cross-organisation isolation

Even at the database level, no agent in one organisation can request a document URL belonging to another.

Australian primary placement

Documents on Cloudflare / AWS object storage with Oceania (Australia / New Zealand) primary placement.

Audit trail

Every document open, download and share is logged. Admins can review the full history.

Compliance

What we comply with.

Every claim on this page is implemented in code. Procurement teams who check the detail will find what we publish is exactly what we run.

  • Australian Privacy Act 1988 / Australian Privacy Principles
  • OMARA Code of Conduct (privacy and confidentiality)
  • GDPR principles for any EU clients you serve
  • OWASP Top 10 aligned (parameterised SQL, input sanitisation, output encoding)
  • Cross-organisation data isolation at the request boundary
  • Role-based permissions (Admin / Member)

Shared Responsibility

Where our responsibility ends and yours begins.

ImmiIQ secures the platform. Your firm secures how it is used. The matrix below makes the line explicit so there is no ambiguity for procurement, compliance or your own internal policy.

ImmiIQ secures
  • AES-256-GCM encryption at rest with a per-organisation key derived such that ImmiIQ engineers cannot read sensitive fields by querying the database.
  • TLS 1.3 in transit on every network hop.
  • AU-only hosting (Sydney ap-southeast-2), AU-pinned document storage.
  • Notifiable Data Breaches scheme compliance, OAIC notification, breach runbooks.
  • Least-privilege engineer access; production access logged and audited.
  • Per-organisation tenancy - your data is sealed off from every other ImmiIQ customer at the database layer.
You secure
  • Account credentials for every user in your firm (strong password, no shared logins).
  • Multi-factor authentication once we ship it; until then, treat passwords like keys.
  • What you do with data once it leaves ImmiIQ - email forwards, exports to your laptop, screenshots in Slack, assistants you delegate access to.
  • Disclosure to government bodies and third parties at your discretion under your professional obligations.
  • Who in your team you grant access to which client records (use our roles and per-module toggles).
  • Revoking access promptly when a team member leaves your firm.

Liability

ImmiIQ is not liable for client data exposure that results from actions taken outside the platform - forwarding emails to unauthorised recipients, exporting documents to personal storage, sharing login credentials or any downstream disclosure inconsistent with your professional obligations. The encryption protections described above apply to data at rest and in transit within ImmiIQ. Once data leaves the platform under your direction, your firm's own controls and obligations govern.

Provider-owned data flows

When you bring your own tools, the shared line moves.

The integrations marketplace at Settings then Integrations lets your firm connect its own Gmail or Microsoft 365 mailbox, its own JustCall or Twilio account for voice and its own Twilio Messaging channel for SMS and WhatsApp Business. Every connection is scoped to your organisation and its credentials are sealed with a per-tenant AES-GCM key derived from your organisation id; plaintext credentials never leave the vault module and are only decrypted in memory when placing a send. Consent copy is version-stamped on every connection row so a change to the shared-liability terms triggers a re-prompt before the integration keeps running. Every connect, disconnect and credential rotation writes an audit row.

Two-way mail sync (Gmail + Microsoft 365) runs on the provider's official OAuth 2 flow with the minimum read plus send scopes. Push events arrive as OIDC-signed Pub/Sub notifications for Gmail and change-notification subscriptions with a per-connection clientState for Microsoft 365; anything that fails signature or state verification is dropped without processing. Voice recordings are re-encrypted with your per-organisation key before they hit our storage - Twilio or JustCall holds the plaintext copy, ImmiIQ holds the encrypted copy, only your firm can decrypt. The recording-URL endpoint returns 403 the moment the caller's active org does not match the row's organisation_id, so cross-org playback is architecturally impossible. WhatsApp Business enforces Meta's 24-hour session-window rule server-side and the composer UI mirrors the same rule so a stale tab cannot bypass it.

What lives on the provider side stays under your firm's control. You own the Google Workspace or Microsoft 365 tenant, the Twilio or JustCall account, the WhatsApp Business sender and every number and mailbox they cover. Disconnecting any tile revokes the token and blanks the sealed blob in the same transaction that closes the connection row; provider-side data (your mailbox, your call recordings on Twilio, your WhatsApp Business history) is governed by that provider's own retention and access policies from that point forward.

Frequently asked

Common questions about your data

The things procurement teams, Registered Migration Agents (RMAs) and law-firm partners ask before signing.

Where is my data stored?
All client records and documents live in Australia. Our database and application servers run in Sydney; document storage is pinned to Australian-only locations. Edge protection runs across a global network with TLS terminated at the closest Australian point of presence.
Is my client data encrypted?
Yes. All data is encrypted in transit with TLS 1.3 and encrypted at rest using industry-standard authenticated encryption. Sensitive personal fields like passport numbers, dates of birth and family details are additionally encrypted using a key unique to your organisation - so even at the database layer, your data is sealed off from every other tenant.
Who at ImmiIQ can read my client information?
Operationally, the encryption keys for your organisation are derived such that ImmiIQ staff cannot read your sensitive client fields by querying the database. Engineers run on a least-privilege model; production access is logged and audited. We do not use your customer data to train AI models - the AI model that powers Harper runs inside our own AWS Sydney VPC with read-only weights, so there is no training feedback loop and no third-party AI provider receives your data.
How is sign-in protected?
Sign-in is passwordless. We email a one-time magic link to your registered address; the link expires in 10 minutes and can only be used once. Sessions last 24 hours and only one active session per user is allowed - if your laptop is stolen and signed in elsewhere, you can sign out everywhere from any device. We rate-limit aggressive attempts and lock out accounts that look brute-forced. Every sign-in attempt is recorded with device and country in your personal security log.
Can my firm restrict sign-in to approved IP addresses?
Yes, on request. ImmiIQ configures an IP allowlist for your firm - sign-ins from any other address are rejected and logged for audit. Useful for firms operating from a fixed office network or VPN. Email security@immiiq.com to set it up.
Can I restrict what each team member sees inside the app?
Yes. Every Pro plan includes per-member access control across three axes. Data scope limits which client records a member can read - all clients, only their team's clients or only clients they're personally assigned to. Module access lets you switch off any of ten surfaces per member (clients, cases, communications, AI, documents, invoices, reports, billing, settings, team management). Role templates let admins build a Finance or Client-Service role once and apply across the team. All restrictions are enforced at the database layer, not just the UI - a direct API call returns the same restricted set the user sees in the app and the AI assistant honours the same scope on every tool call. More on team permissions.
Does Harper (your AI assistant) ever see another firm's client data?
No. Strict tenant isolation is enforced on every Harper request. Harper only ever sees clients that belong to your organisation. Every tool that touches client data verifies ownership before reading; cross-organisation attempts are rejected and recorded. Harper is also instructed to refuse to speculate when its tools return no data, so it cannot 'invent' details about a client it has not been authorised to see.
When I use Harper, where does my data go?
Harper is opt-in - you only invoke it when you open the AI panel and submit a prompt. When you do, the prompt plus any client or case context you explicitly attach is processed inside ImmiIQ's own AWS Sydney VPC (region ap-southeast-2). Your data does not leave that region and is not sent to any third-party AI provider - no OpenAI, no Anthropic, no Google AI. The model runs on read-only weights inside our VPC, so there is no training feedback loop; your prompts can never influence the model's behaviour for other customers. Our mobile applications do not connect to any AI provider directly - the mobile app talks only to our servers and AI inference is handled in our backend. Per-organisation AES-256-GCM encryption protects your at-rest data independently of any AI processing. Full breakdown, including what is and is not processed, is in our privacy policy.
Are you compliant with the Australian Privacy Act 1988?
ImmiIQ operates under the Australian Privacy Principles (APPs). Personal information is collected only as necessary to provide the service, used only for the disclosed purposes and stored on infrastructure pinned to Australia. Our full privacy policy covers collection, retention, breach notification, access and correction rights.
Do you use subprocessors? Where do they store data?
Yes - a small set of established cloud providers, all configured to keep your client data in Australia. The full list, their roles and Australian regions is available on request for procurement reviews.
How do I export or delete my data?
Account owners can export every client record, communication, document and audit log at any time from the in-app export tools. On account closure we honour deletion requests in line with our retention policy and the Australian Privacy Act - typically within 30 days, with explicit confirmation. Backups age out on a defined retention schedule.
What happens if there's a data breach?
We follow the Notifiable Data Breaches scheme under the Privacy Act 1988. If we believe a breach is likely to result in serious harm, we notify affected customers and the Office of the Australian Information Commissioner (OAIC) without undue delay. Internally we run incident-response runbooks for triage, containment, eradication and post-incident review. Our security contact for responsible disclosure is security@immiiq.com.
How long do you keep my data after I cancel?
On request after cancellation, we delete your live data within 30 days. Encrypted backups age out within a further 90 days under the standard backup retention schedule. Audit-log entries required for legal/compliance purposes (e.g. who accessed what, when) are retained for 7 years per Australian record-keeping standards, then deleted.
How are two-way email sync credentials secured?
OAuth tokens for connected Gmail and Microsoft 365 mailboxes are sealed with AES-256-GCM using the same per-org envelope as every other integration credential and are never logged. Gmail push events arrive as OIDC-signed Pub/Sub notifications with the audience pinned to the push endpoint URL and are dropped otherwise; Microsoft 365 change notifications carry a per-connection random clientState that is verified on every inbound call. Mailboxes are scoped per user, not per org, so an agent's mailbox never becomes shared infrastructure. Disconnecting revokes the token and blanks the sealed blob in the same transaction that closes the connection row.
How are bring-your-own phone credentials and call recordings protected?
Twilio and JustCall credentials are sealed with AES-GCM per-org keys before touching the database and never leave the vault module. Every provider webhook is HMAC-verified against your own connection's secret over the canonical URL and sorted-parameter form, so a forged callback from a different tenant can never write into your call history. Recording bytes are re-encrypted with a per-organisation key before they hit ImmiIQ storage and are only reachable through 5-minute signed URLs generated after a fresh org-membership check - cross-org playback returns 403 the moment the caller's active org does not match the row's organisation_id.
How do WhatsApp Business messages stay inside Meta's rules?
Twilio Messaging credentials are sealed in the same per-org integration vault (AES-256-GCM with per-org HKDF keys, identical envelope to Xero and backup destinations). Provider webhook receipts are HMAC-verified through the shared helper and deduped in the integration webhook-events table so a replay cannot double-write a delivery status. Outbound sends respect Meta's 24-hour customer-care session-window server-side; the composer UI mirrors the same rule client-side so a stale tab cannot bypass it. Freeform copy is only allowed if the client messaged in within the last 24 hours; otherwise only Meta-approved templates leave the platform.
Who is responsible for the data on the provider side?
Your firm is. ImmiIQ secures the credential vault, the webhook verification, the per-org encrypted recording copy and the audit trail on our side. What lives on the provider side - the mailbox on Google Workspace or Microsoft 365, the plaintext recording on Twilio or JustCall, the WhatsApp Business message history on Meta - is governed by that provider's own retention, access and encryption policies. Disconnecting any tile drops our sealed credentials immediately; the provider-side data stays under your control.
Can I keep my own copy of client files outside ImmiIQ?
Yes. Every Pro plan includes bring-your-own backup - connect Google Drive, OneDrive, Dropbox or any S3-compatible bucket (AWS S3, Cloudflare R2, Backblaze B2, Wasabi, MinIO) and ImmiIQ writes a daily plaintext copy of your client and sponsor documents into a folder or bucket you own. Firms pick Archive (append-only, a delete in ImmiIQ never touches the destination copy) or Mirror (deletes propagate within about 15 minutes) and the hour of day the backup runs, in their own timezone. Your ImmiIQ-hosted copy stays encrypted with our per-organisation key regardless; the destination copy is under your firm's control, so its access policy (who can view the Drive folder, whether the bucket is public, MFA on the destination account) is your responsibility. You can disconnect at any time.

Security contact

Found something? Tell us.

Responsible disclosure welcome. We respond within one business day and credit researchers in our public security log if requested.

security@immiiq.comPrivacy policy

For procurement requests, please email sales@immiiq.com.