Trust & Safety
Less data held. Less to worry about.
InvestPass is designed to keep as little personal information as possible. Here is exactly what we keep in our database, what stays with our verification provider, and how it is looked after.
Who holds what
What we store vs what Personr stores.
Personr, our verification provider, runs the identity checks and keeps the evidence. InvestPass keeps just enough to show you the result.
| Information | InvestPass | Personr | Notes |
|---|---|---|---|
| Client name, email and mobile | Needed to send the link and show results | ||
| Check status and simple result | |||
| Personr reference number | Lets us fetch details when you need them | ||
| Company or trust name and ABN/ACN | |||
| ID document images | |||
| Selfies and face match data | |||
| Date of birth and ID numbers | |||
| Detailed AML screening results | Only match counts are kept | ||
| Verification report PDFs | Report access is awaiting Personr confirmation | ||
| Consent timestamps and internal references | |||
| Business display names and membership roles |
This describes how InvestPass is being designed. The live service is not launched yet and these details will be confirmed before launch.
Access
Who in your team can see what.
Owner
Manages the business account, team and billing.
Compliance officer
Starts and reviews checks and sees all results.
Staff
Starts checks and sees the ones they started.
Viewer
Read only access to results.
Auditor
Time limited read only access for a reviewer.
Business access is controlled by organisation membership. Viewer and Auditor roles are read only.
Where
Current hosting and our plan.
Verification status records are stored in our database, currently hosted with our cloud provider outside Australia. Moving records to an Australian region is planned before live launch.
Retention
Kept only as long as needed.
Retention, deletion and export arrangements will be confirmed before live launch and reviewed against applicable record keeping obligations. Automatic retention and export controls are not available yet.
Logs
Minimal information in our records.
InvestPass code is written so names, contact details and verification responses are not written to application logs. Messages from Personr are trimmed to a status and reference before anything is kept.
Incidents
If something goes wrong.
We'll act quickly to contain any issue, assess the impact, and tell affected businesses and the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme requires it.
Read our Privacy Policy, Data Processing and Terms. These are drafts pending legal review.
FAQ