Business sign in
Email and password sign in protects business pages. New accounts require email confirmation. Multi factor authentication is not implemented yet.
Security
Designed for data that has to be defensible.
Client verification data is among the most sensitive information a business holds. InvestPass treats isolation, access control and auditability as structural requirements.
Controls
Security controls in the platform design.
Organisation access
Database rules restrict records to organisation members. Viewer and Auditor roles are read only. Staff can operate their own checks.
Minimal records
Verification status records are stored in our database. ID images, selfies, birth dates and addresses are not stored by InvestPass.
Current hosting
Records are currently hosted with our cloud provider outside Australia. Moving to an Australian region is planned before live launch.
Audit entries
Verification creation and updates, consent acceptance and processed provider events generate audit entries.
Documents stay with Personr
Trust deeds pass through to Personr and are not saved in InvestPass. Document downloads are not available.
Audit logging
What gets recorded.
Audit records exist so a decision can be reconstructed later, who did what, when, and on which record.
- Verification creation
- Verification updates
- Consent acceptance
- Processed Personr events
What we do not claim
InvestPass does not hold SOC 2 or ISO 27001 certification, and makes no claim of AUSTRAC approval, regulatory endorsement or government accreditation. This page describes controls in the platform's design. Any future certification will be published here with evidence.
Reporting a vulnerability: please contact us so we can assess and respond. We ask that issues are reported privately before any public disclosure.