ImmiPractice hosts each business’s data in its own region (Canadian firms in Canada), encrypts it in transit and at rest, backs it up daily for 30 days, and uses passwordless email-code sign-in with seven roles and branch isolation. SOC 2 Type II status: in progress; no certification is claimed yet. Incidents affecting your data are reported without undue delay. Below are short answers to the questions immigration firms ask most.
- Data and backups are hosted in each business’s region (Canada for Canadian firms) and encrypted.
- SOC 2 Type II status: in progress; no third-party certification is claimed yet.
- Passwordless sign-in means work email needs MFA.
- Incidents are reported to affected customers without undue delay.
Where is our data stored?
Canadian businesses’ data and backups stay in Canada. ImmiPractice also runs regions in the US, Europe, Australia and Brazil (serving Africa), and each business’s data — client profiles, case records, uploaded documents, agreements, signatures and backups — stays in its own region. If you connect WhatsApp or Meta Lead Ads, those messages and leads also pass through Meta's platform. See infrastructure.
Is client data encrypted?
Yes. ImmiPractice is served only over HTTPS (TLS), and database records, uploaded documents and backups are encrypted at rest. See encryption.
Does ImmiPractice have SOC 2 certification?
Not yet. SOC 2 Type II status: in progress. Until the audit is complete we claim no third-party certification. Written policies mapped to SOC 2 criteria are being documented and can be shared during procurement, and the report will be available to customers on request once issued.
How often is data backed up?
Daily. Backups are encrypted, stored in your business’s region (Canada for Canadian firms) and kept for 30 days. Our recovery point objective is 24 hours and our recovery time objective is 8 hours. These are objectives, not guarantees. See backup and disaster recovery.
Why is there no password?
Staff and clients sign in with a 6-digit code sent by email. No login passwords are stored, so none can be reused, shared or leaked. The trade-off is that email security matters more: protect every work mailbox with multi-factor authentication. See passwordless sign-in explained.
Does ImmiPractice support SSO or an authenticator app?
Not today. The email code is the sign-in factor. Add a second layer by turning on MFA at your email provider.
Who on our team can see what?
Seven roles control access: Business Admin, Branch Manager, Manager, Receptionist, Calling Team, Filing Team and Accounts Team. Branches are isolated, receptionists never see enrolled cases, filing staff see only assigned cases, and only the Business Admin can change permissions. See roles and permissions.
Can ImmiPractice staff see our client files?
The internal back office shows account, plan and billing information only and has no screens for browsing client records. It uses a separate login, and production access is limited to the people who operate the service.
What happens when an employee leaves?
Deactivate them in Team & Roles; their access ends on their next request. Also disable their work mailbox so no sign-in codes reach them. See the account security checklist.
Will you tell us about a breach?
Yes. If an incident affects your data, we notify you without undue delay and give you the facts you need for your own obligations, including PIPEDA breach reporting where required. See incident response.
Who else processes our data?
A hosting provider in your workspace’s region, an email delivery provider, Stripe for subscription billing (card details are never stored by ImmiPractice), and Meta only if you connect WhatsApp or Lead Ads. AI add-ons may use additional providers, listed for customers who enable them. See subprocessors.
How do we report a vulnerability or get a questionnaire completed?
Email sales@immipractice.com with "Security" in the subject. Vulnerability reports follow our responsible disclosure policy. For vendor security questionnaires, send the questionnaire to the same address.