Security & trust centre
Built for security — with the details to prove it
Immigration files hold passports, finances and family histories. This page sets out how ImmiPractice hosts, encrypts, backs up and protects them — and what we are still working towards.
ImmiPractice hosts all customer data and backups in Canada, encrypts client data in transit and at rest, takes daily backups kept for 30 days (RPO 24 hours, RTO 8 hours), and controls access with passwordless sign-in, seven roles and branch isolation. Customers are notified of incidents affecting their data without undue delay. SOC 2 Type II is in progress; no third-party certification is claimed until it is complete.
Canadian data residency
All ImmiPractice customer data is hosted in Canada — client profiles, case records, uploaded documents, agreements, signatures and backups. Your clients’ information does not leave the country to be stored.
If you choose to connect WhatsApp or Meta Lead Ads, messages and leads also pass through Meta’s platform under Meta’s own terms (see subprocessors).
Encryption
Backups & disaster recovery
Backups are encrypted and stored in Canada. In a disaster, we restore service from the most recent backup, aiming to be back online within 8 hours with no more than 24 hours of data lost. These are objectives, not guarantees; we will report the actual timeline to affected customers after any incident.
Access control in the product
Passwordless sign-in
Staff sign in with their work email and a 6-digit one-time code. No staff passwords are stored, so there are none to reuse, share or leak. Clients use the same one-time-code approach for the Form Menu and portal.
Role-based access
Seven built-in roles control which modules and records each person can open. Every permission check runs through one central function, so a rule applies everywhere at once.
Branch-level isolation
Each branch’s leads, cases and team are separated. Only the Business Admin sees across branches. Receptionists never see enrolled cases; filing staff see only cases assigned to them.
Admin-only permission changes
Only the Business Admin can edit the permission grid, so nobody can grant themselves extra access.
Private file storage
Documents and payment proofs are stored in a private location that blocks direct web access and are served only through handlers that check the viewer’s permission.
Audit trail on agreements
Every agreement event — sent, viewed, reminded, signed, expired, superseded — is recorded on its audit trail.
Instant deactivation
Deactivate a team member and their access ends on their next request. With no password to keep, a departing employee has nothing left to sign in with.
Consent-based messaging
WhatsApp broadcasts go only to contacts marked as opted in; email campaigns include unsubscribe handling.
Employee access
- ImmiPractice’s internal back office shows account, plan and billing information for each business. It does not include screens for browsing your clients’ records.
- The back office uses a separate login from the customer application.
- Access to production systems is limited to the people who operate the service.
Our written internal access policy is being documented as part of our SOC 2 work and can be reviewed on request.
Incident response
- Detect & containInvestigate the alert or report, and stop further exposure.
- AssessWork out what data and which customers are affected, and the risk of harm.
- NotifyTell affected customers without undue delay, with what happened and what we are doing.
- SupportGive you the facts you need for your own obligations, including PIPEDA breach reporting where required.
- ReviewFix the root cause and record what we changed.
To report a security issue, email sales@immipractice.com with “Security” in the subject, or call +1 289-906-3018. We welcome responsible disclosure.
Data retention & deletion
- You control your data. Your business decides what client information is stored and for how long.
- Soft delete where records matter. Leads are deactivated rather than erased so history is not lost by accident, and payments cannot be deleted once an invoice has been issued.
- Export or deletion on request. A Business Admin can ask us to export or delete the business’s data by emailing sales@immipractice.com.
- Backups age out. Deleted data remains only in encrypted backups until they expire after 30 days.
Subprocessors
Third parties that may process customer data to deliver ImmiPractice.
| Provider | Purpose | Location | When used |
|---|---|---|---|
| Canadian hosting provider | Application hosting, database, file storage and backups | Canada | Always |
| Email delivery (SMTP) provider | Sign-in codes, notifications, invoices and reminders | See provider | Always |
| Stripe | ImmiPractice subscription billing. Card details are handled by Stripe and never stored by ImmiPractice | See Stripe | When you subscribe |
| Meta Platforms | WhatsApp Cloud API messages and Facebook/Instagram Lead Ads | See Meta | Only if you connect WhatsApp or Lead Ads |
AI add-ons may use additional providers; we list them for customers who enable those add-ons. We keep this list up to date.
Security roadmap
We would rather tell you what is in progress than overstate where we are.
An independent audit of our security, availability and confidentiality controls over time. We will publish progress here, and the report will be available to customers on request once issued.
Written security and privacy policies mapped to SOC 2 criteria, available to customers during procurement.
Comparing vendors? See our IRCC & PIPEDA compliance checklist. Need a security questionnaire completed for procurement? Email sales@immipractice.com.
Security library
Each topic above, in depth — written for the person in your firm who answers client and procurement questions about data security.
Overview
Data protection
Access & accounts
Operations & response
Security questions
Is ImmiPractice SOC 2 certified?
Not yet. SOC 2 Type II is in progress. Until the audit is complete we do not claim any third-party certification — this page describes the controls in place today.
Where is our data stored?
In Canada. All ImmiPractice customer data — client records, documents, agreements, signatures and backups — is hosted in Canada.
Is client data encrypted?
Yes. Client data is encrypted in transit with TLS and encrypted at rest.
How often is data backed up, and how fast can you recover?
Daily backups kept for 30 days. Our recovery point objective (RPO) is 24 hours and our recovery time objective (RTO) is 8 hours.
Will you tell us about a data breach?
Yes. If an incident affects your data, we notify you without undue delay and help you meet your own obligations, including breach reporting under PIPEDA where required.
What happens when a team member leaves?
Deactivate them in Team settings. Sign-in uses one-time codes sent to their work email, so they have no password to keep using and their access ends on their next request.