Security & Data Residency
How client documents and case records are handled, what safeguards apply and where to get help with your agency's requirements.
Last updated: October 2026
Where Is My Data Stored?
Account and case information is held in hosted databases; documents and generated files use separate cloud file storage. Storage, any backups and connected services can have different locations. We do not provide a blanket Australian-only storage or processing guarantee. If your agency has a location requirement, contact us before supplying information. Read more in our Privacy Policy.
How Are Connections & Downloads Protected?
Your connection to Immi Flow is encrypted using HTTPS. Document download links expire, which limits how long they can be used. Keep those links private: anyone who receives a working link may be able to open the file. Share documents only with the intended recipient.
How Are Uploads Checked?
Supported case-document uploads through the client portal and agency dashboard, and connected cloud imports, are checked for malware. Uploads can also be checked for file size and type. Where a scan is required, the upload is refused if a threat is found or the scan cannot finish safely. These checks reduce risk; keep your own devices protected too.
Can I Keep Copies of My Records?
Document downloads and separate exports for settings, conversations and compliance audit records support your agency's record keeping. Export contents depend on the tool and selected records. Keep the copies your practice needs before paid access ends. See our export and cancellation terms and retention and deletion information.
Who Can Access My Information?
Your team and invited clients see information through their account or portal permissions. Your agency decides who gets an account or portal link. Authorised staff may need access to relevant information to help with support or maintain the service. Our Privacy Policy explains sharing with connected services.
Audit records help your agency review supported actions, consent and AI reviews. Download the records your practice needs and keep your client files for the required period. An audit export helps explain activity on a file; it does not replace keeping a full copy of the client file.
What Happens When AI Is Used?
AI helps your team read documents, organise evidence and prepare checks for review. It uses relevant information from the case, and drafts may be saved before anyone checks them. Your migration agent or legal practitioner makes the professional decisions; AI results can contain mistakes.
- Consent and choice: Your agency must explain AI use and obtain written client consent. For applicants uploading case documents through the portal, Immi Flow checks recorded AI permission before accepting the upload and checks it again before AI processing. If you decline or withdraw AI permission, you cannot upload applicant case documents through the portal. Contact your agency to arrange another way to send documents and receive help without AI.
- Retention: Saved case records and drafts remain subject to retention requirements. Limited retention by processing services may also apply for security, abuse prevention or service operation.
- Professional responsibility: AI output can contain errors. Using AI does not replace the migration agent's or legal practitioner's responsibility for their work.
- Further information: Read our AI processing and consent information and OMARA's guidance.
What If I Lose Access or Suspect a Security Incident?
If you cannot access your case or portal, contact your agency for help with access and copies of your documents. Report suspected unauthorised access, exposed links or lost information to our security contact below. Include the time, affected feature and steps that led to the concern, without sending passwords or client documents.
We investigate reported concerns and assess who is affected and what needs to happen next. Where the law requires notification, we notify affected people and the regulator as soon as practicable. Recovery depends on the incident and the records available. Keep independent copies of files your practice must retain.
Report a Security Concern
Contact security@immiflow.com.au for security concerns or vulnerabilities. For privacy requests, data-location questions, corrections or deletion, contact privacy@immiflow.com.au or read our privacy request and complaint process.