Security & Data Protection Dossier

Executive Summary

VisaChief.com operates a visa and immigration platform that handles some of the most sensitive personal information a citizen will ever surrender: passports and travel documents, national identity numbers, biometric photographs, health and character declarations, financial evidence, family relationships and migration history. We treat that data as the crown jewels it is.

This page sets out, without marketing abstraction, the technical and organisational measures that protect it. It is written for assessors: every control is stated in terms that can be tested, and every claim is supported by evidence available under NDA during due diligence.

Five commitments to a government buyer

• Sovereignty is non-negotiable. In-scope personal information is stored and processed in Australian regions. Offshore access is denied by default and permitted only where an agency has expressly approved it in the contract schedule.
• Zero trust, not perimeter trust. Every request - human or machine - is authenticated, authorised, and logged against an explicit policy. There is no trusted internal network.
• Cryptography is engineered for the next decade. TLS 1.3 in transit, AES-256-GCM at rest, field-level encryption for identity documents, and hybrid post-quantum key exchange on our edge to defend against harvest-now-decrypt-later collection.
• AI is governed, not assumed. Customer data is never used to train third-party foundation models. Model interactions are isolated, prompt-injection tested, PII-minimised before inference, and consequential outputs remain under registered-agent human review.
• Assurance is independent. Annual CREST/OSCP-led penetration testing, continuous vulnerability management, an ISO/IEC 27001 and SOC 2 aligned control set, and contractual audit rights for the agency.

Scope, Systems & Data Handled

This dossier covers the VisaChief.com production platform and the services an agency would consume under contract. Corporate IT is in scope only where it can reach production data.

Systems in scope

Categories of personal information

Governance, Risk & Compliance

Security is owned at executive level. The Chief Technology Officer is accountable for the information security management system; a Privacy Officer is separately accountable for obligations under the Privacy Act 1988 (Cth). Risk is reviewed on a fixed cycle and on material change, with a documented risk register, treatment plans and named owners.

Obligations we design against

Control framework

• Primary library: ISO/IEC 27001:2022 Annex A (93 controls), each with an owner, implementation statement, and evidence artefact.
• Cross-maps maintained: ISM controls (OFFICIAL / OFFICIAL: Sensitive), Essential Eight maturity, SOC 2 Trust Services Criteria, NIST CSF 2.0 functions, and CIS Critical Security Controls v8.
• Statement of Applicability is a living document; exclusions are justified in writing and reviewed at each cycle.
• Policy suite covers information security, acceptable use, access control, cryptography, secure development, change management, incident response, business continuity, supplier security, data retention, privacy, and AI use. Policies are versioned and acknowledged annually.

Assurance roadmap

We state assurance status plainly. Nothing below is claimed as achieved until an independent party has issued a report or certificate, and current artefacts are provided on request.

Data Sovereignty & Residency

Sovereignty is the first question a public-sector buyer asks, and the one most often answered vaguely. Our position is specific.

Enforcement mechanisms

• Cloud organisation policy denies resource creation outside approved Australian regions across all accounts, including sandbox.
• Infrastructure-as-code is scanned pre-merge; a region violation is a hard build failure.
• Storage buckets and databases carry residency tags; a daily reconciliation job alerts on any untagged or out-of-region asset.
• Egress from production to the public internet is restricted to an allow-list of destinations, logged in full, and reviewed monthly.

Identity & Access Management

We operate on the assumption that credentials will be phished and endpoints will be compromised. Access controls are therefore designed so that a stolen password, a stolen session, or a compromised laptop is insufficient to reach applicant data.

Workforce access

Applicant and agency-user access

• Passwords are hashed with a memory-hard function (Argon2id) and checked against breached-credential corpora at set and at login.
• Multi-factor authentication is available to all applicants and enforceable by policy for agency tenants; passkeys are supported.
• Enterprise tenants may federate via SAML 2.0 or OIDC with SCIM provisioning, so an agency's own joiner-mover-leaver process governs platform access directly.
• Sessions are short-lived, bound to device and network context, invalidated on privilege change, and terminated on anomaly. Concurrent-session limits and geo-velocity checks are enforced.
• Every access to an identity document is written to an append-only audit record naming the actor, case, purpose and timestamp. Agencies can subscribe to this feed for their own tenancy.

Cryptography & Key Management

Encryption is applied in depth rather than at a single layer, and the key hierarchy is designed so that compromise of storage, of a backup, or of a single service does not yield plaintext.

Post-quantum readiness

Immigration records retain their sensitivity for decades - a passport scan harvested today is still damaging in 2040. That makes harvest-now, decrypt-later collection a live threat rather than a theoretical one, and it is why our cryptographic roadmap is already moving.

• Hybrid key exchange at the edge. Our TLS termination supports hybrid post-quantum key agreement (X25519 combined with ML-KEM, per NIST FIPS 203), so session keys resist both classical and future quantum attack while remaining interoperable with today's clients.
• Cryptographic inventory. We maintain a machine-readable register of every algorithm, key length and protocol in use - the precondition for any credible migration.
• Crypto-agility by design. Algorithms are referenced through an abstraction layer, so a primitive can be replaced without re-architecting the application.
• Signature migration path. ML-DSA (FIPS 204) is on the roadmap for artefact and document signing, tracked against ACSC and NIST guidance, with long-lived signatures prioritised first.

Application & Product Security

Security is enforced in the pipeline, not requested of developers. A change cannot reach production without passing the gates below.

Secure development lifecycle

Application defences

• OWASP Top 10 and API Top 10 controls verified by test, including parameterised data access, output encoding, strict content security policy, and anti-CSRF protections.
• Object-level authorisation is enforced centrally - the most common cause of data exposure in multi-tenant systems is checked in one place and tested continuously.
• Uploaded documents are treated as hostile: type verification, size limits, multi-engine malware scanning, content disarm and reconstruction for office formats, quarantine on suspicion, and rendering from an isolated origin with no ambient credentials.
• Rate limiting, bot management and adaptive challenge protect enumeration-prone endpoints such as eligibility checks and status lookup.
• Web application firewall and managed DDoS protection sit in front of all public endpoints.
• Non-production environments never contain live personal information; test data is synthetic or irreversibly de-identified.

Vulnerability management

AI Assurance & Model Security

VisaChief.com is an AI-native platform, and AI introduces failure modes that traditional security reviews do not cover. We treat models as an untrusted, non-deterministic component operating inside a governed boundary.

Data protection in AI processing

• No training on customer data. Contracts with model providers prohibit the use of our inputs or outputs to train, fine-tune or improve their models. Zero-data-retention processing is used where the provider offers it.
• Minimisation before inference. Personal information is reduced to what the task requires; direct identifiers are redacted or tokenised before a prompt leaves our boundary, and re-hydrated only within our own trust zone.
• Biometric-adjacent exclusion. Passport photographs and signature images are not sent to third-party general-purpose models.
• Residency for inference. Where an agency requires it, inference is served from Australian-region endpoints or from models hosted within our own tenancy.

Model and pipeline security

AI governance

• An AI management system aligned to ISO/IEC 42001 and the NIST AI Risk Management Framework, consistent with Australia's AI Ethics Principles and the Voluntary AI Safety Standard.
• A model register recording every deployed model, its purpose, data flows, evaluation results, human-oversight design and accountable owner.
• Automated-decision transparency: applicants are told where AI assists their matter, and no adverse consequential decision is made by a model without human review.
• Full prompt-and-response logging within our boundary for investigation, with the same retention, encryption and access controls as case data.

Infrastructure & Network Security

Detection, Response & Breach Notification

Monitoring

• Centralised logging from application, infrastructure, identity, and cloud control planes into a SIEM with correlation and behavioural analytics.
• Security logs are written to append-only, immutable storage with independent retention, so an attacker with production access cannot erase their trail.
• Detection content covers credential abuse, impossible travel, privilege escalation, mass document access, data-exfiltration patterns, and anomalous AI usage.
• Alerting is triaged 24x7 with defined escalation to on-call security engineering.

Incident response

• The incident response plan is exercised at least annually, including a tabletop with executive participation and a technical simulation of a data-exfiltration scenario.
• Retained external digital forensics and incident response capability is available on call.
• Cyber liability insurance is maintained; certificates of currency are provided on request.
• A dedicated agency incident contact and escalation matrix is agreed at contract signature.

Resilience, Backup & Continuity

Supply Chain & Third-Party Risk

Most modern breaches arrive through a supplier. Our third-party controls are therefore treated with the same rigour as our own.

• Register and transparency. A current sub-processor register lists each provider, its purpose, the data categories it touches, and its hosting location. Agencies are notified before a new sub-processor handling personal information is engaged, with a right to object.
• Risk-tiered due diligence. Providers touching personal information undergo security review before engagement: certification evidence, penetration-test attestation, breach history, sub-processing chain and residency.
• Contractual flow-down. Confidentiality, security standards, breach notification timelines, audit rights, residency obligations and deletion duties are imposed contractually on every provider in scope.
• Registered agent network. Partner migration agencies are bound by confidentiality undertakings, access is scoped to assigned cases only, and every document view is logged and attributable.
• Continuous monitoring. Provider security posture, advisories and incident disclosures are monitored; material degradation triggers reassessment.
• Software supply chain. Dependencies are pinned, provenance-verified and continuously scanned; an SBOM is maintained per release and can be supplied to the agency.
• Concentration risk. Critical dependencies have documented alternates and, where practical, tested migration paths.

Personnel & Physical Security

Privacy by Design & Data Lifecycle

Principles in practice

• Collect less. Each field is justified against a lawful purpose; optional data is clearly marked; we do not collect sensitive information unless the visa route requires it.
• Tell people plainly. Layered collection notices explain what is collected, why, who receives it and how long it is kept - in plain language, at the point of collection.
• Separate by purpose. Analytics operate on de-identified or aggregated data; marketing systems never receive identity documents or sensitive declarations.
• Give control. Access, correction, export and deletion requests are handled through a documented workflow with identity verification and statutory timeframes.
• Assess before building. Privacy impact assessment is triggered by any new processing of personal information, new sub-processor, or new automated decision.

Retention and destruction

Destruction is irreversible: cryptographic erasure of tenant keys is used alongside logical deletion, so residual ciphertext is unrecoverable. Certificates of destruction are issued on request.

Independent Assurance & Testing

• Penetration testing. Independent testing of the application, API and cloud infrastructure at least annually and before any major architectural change, conducted by appropriately accredited testers. Findings are tracked to closure against the vulnerability SLAs; an executive summary and remediation status are shared with agency clients.
• Red teaming. Objective-based exercises against realistic adversary tradecraft, including social engineering with executive authorisation, to test detection and response rather than configuration.
• Continuous scanning. Authenticated and unauthenticated scanning of external and internal surfaces, dependency monitoring, container and IaC scanning integrated into the pipeline.
• Vulnerability disclosure. A published policy with a safe-harbour statement, a monitored intake channel, acknowledgement within two business days, and coordinated disclosure.
• Internal audit. Scheduled control testing against the Statement of Applicability with findings reported to the executive.
• Agency audit rights. Contracts provide for the agency to audit - or to appoint an auditor for - controls relevant to its data, on reasonable notice and subject to confidentiality.

Shared Responsibility Model

Clear demarcation prevents the gaps where incidents happen.

Service Commitments

Contact & Vulnerability Disclosure

For how VisaChief connects to a department's visa processing system, see the companion document: Government Integration Layer - Architecture & Interface Guide.