ImmiPractice runs its application, database, file storage and backups in five regions (Canada, the US, Europe, Australia and Brazil, which serves Africa); each business stays in its own region, so Canadian firms’ data and backups stay in Canada. Uploaded files are kept in private storage with no direct web access. Access to production systems is limited to the people who operate the service, and the internal back office uses a separate login and shows only account, plan and billing data. Third parties that process data, such as Stripe, Meta and the email provider, are listed as subprocessors.
- Application, database, files and backups stay in each business’s region; Canadian firms stay in Canada.
- Meta only processes data if the firm connects WhatsApp or Lead Ads.
- Production access is limited to the people who operate the service.
- Provider names and data-centre details are not yet published; ask sales@immipractice.com for procurement questions.
Where is ImmiPractice hosted?
ImmiPractice runs in five regions: Canada, the United States, Europe, Australia and Brazil (which serves customers in Africa). Each business is placed in one region, and its data — the database, uploaded documents, agreements, signatures and backups — stays there. For Canadian firms, data and backups stay in Canada: your clients’ information does not leave the country to be stored.
For many Canadian immigration practices, data residency is the first question clients and regulators ask. Canadian privacy law does not generally forbid storing personal information abroad, but it does expect you to protect it and to be open with clients about it. Keeping everything in Canada removes a whole category of explanation from your privacy notice. Québec's Law 25 adds a specific assessment before personal information is communicated outside the province; read our Law 25 guide for what that means for your practice.
What leaves your region, and when?
Some features depend on third parties that run their own platforms:
| Provider | Purpose | When used |
|---|---|---|
| Hosting provider (region of the customer’s workspace: Canada, US, Europe, Australia or Brazil) | Application, database, file storage, backups | Always |
| Email delivery (SMTP) provider | Sign-in codes, notifications, invoices, reminders | Always |
| Stripe | ImmiPractice subscription billing | When you subscribe |
| Meta Platforms | WhatsApp Cloud API and Facebook/Instagram Lead Ads | Only if you connect them |
AI add-ons may use additional providers; these are listed for customers who enable those add-ons. The current list lives on the subprocessors page.
How is the application separated from the internet?
The app is served only over HTTPS. Uploaded files are kept in a private location that blocks direct web access; every file request goes through a handler that checks the viewer's permission. Every permission check in the product runs through one central function, so a rule is enforced consistently rather than page by page.
Inside each business, every branch's leads, cases and team are separated, and only the Business Admin sees across branches.
Who at ImmiPractice can reach production?
- Access to production systems is limited to the people who operate the service.
- The internal back office shows account, plan and billing information for each business. It has no screens for browsing your clients' records.
- The back office uses a separate login from the customer application.
Our written internal access policy is being documented as part of SOC 2 work and can be reviewed on request.
What we do not publish yet
We do not currently publish the hosting provider's name, data-centre locations, network architecture diagrams or penetration-test results. As the SOC 2 programme progresses (status: in progress), more of this will be documented and available to customers during procurement. If you need a specific answer for a vendor assessment now, ask sales@immipractice.com.
Availability
The status page runs live checks against the app and the website. Backup and recovery objectives are covered in backup and disaster recovery.